{ "generated_at": "2026-08-23T05:10:01+00:00", "source": "pqcrypta-proxy curated database + live observations", "total": 317, "of": 317, "tiers": { "curated": 179, "observed": 138 }, "query": { "q": "", "class": "all", "tier": "all", "sort": "default" }, "license": "CC BY 4.0", "docs": "https://pqcrypta.com/ja4/", "entries": [ { "hash": "01319090aea981dde6fc8d6ae71ead54", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "vpnkit", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "028563cffc7a3a2e32090aee0294d636", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "java,eclipse,STS", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "0411bbb5ff27ad46e1874a7a8beedacb", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "eclipse", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "093081b45872912be9a1f2a8163fe041", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "java", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "0ef9ca1c10d3f186f5786e1ef3461a46", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "bitgo,ShapeShift", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "0fe51fa93812c2ebb50a655222a57bf2", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "LINE Messaging", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "106ecbd3d14b4dc6e413494263720afe", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "node.js,Postman,WhatsApp", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "107144b88827da5da9ed42d8776ccdc5", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "geod", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "116ffc8889873efad60457cd55eaf543", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "Spark", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "187dfde7edc8ceddccd3deeccc21daeb", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "eclipse,java,studio,STS", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "190dfb280fe3b541acc6a2e5f00690e6", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "Used by many programs,Quip,Spotify,Dropbox,GitHub Desktop,etc", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "193349d34561d1d5d1a270172eb2d97e", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "LogMeIn Client", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "1fbe5382f9d8430fe921df747c46d95f", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "FieldServiceApp,socialstudio", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "2080bf56cb87e64303e27fcd781e7efd", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "java", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "225a24b45f0f1adbc2e245d4624c6e08", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "java", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "2d3854d1cbcdceece83eabd85bdcc056", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "Tableau", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "2db6873021f2a95daa7de0d93a1d1bf2", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "java,studio,eclipse", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "2e094913d88f0ad8dc69447cb7d2ce65", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "LINE Messaging", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "32e4b8812cda0c0d50783b438492a769", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "curl 8.x (observed 2026-07-31)", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "38cbe70b308f42da7c9980c0e1c89656", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "p4v,owncloud", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "3959d0a1344896e9fb5c0564ca0a2956", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "LeagueClientUx", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "39cf5b7a13a764494de562add874f016", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "Steam OSX", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "3afe1fb5976d0999abe833b14b7d6485", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "java", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "3b844830bfbb12eb5d2f8dc281d349a9", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "java", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "3e860202fc555b939e83e7a7ab518c38", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "hola_svc", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "4056657a50a8a4e5cfac40ba48becfa2", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "java,eclipse", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "424008725394c634a4616b8b1f2828a5", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "Charles,java,eclipse", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "488b6b601cb141b062d4da7f524b4b22", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "Used by many programs,Python,PHP,Git,dotnet,Adobe", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "4990c9da08f44a01ecd7ddc3837caf25", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "eclipse", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "49a341a21f4fd4ac63b027ff2b1a331f", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "Skype", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "49a6cf42956937669a01438f26e7c609", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "AIM", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "49de9b1c7e60bd3b8e1d4f7a49ba362e", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "nwjs,Chromium", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "4fcd1770545298cc119865aeba81daba", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "Deezer", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "51a7ad14509fd614c7bb3a50c4982b8c", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "java", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "550628650380ff418de25d3d890e836e", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "java", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "5507277945374659a5b4572e1b6d9b9f", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "apple.geod", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "561145462cfc7de1d6a97e93d3264786", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "Airmail 3", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "56ac3a0bef0824c49e4b569941937088", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "hola_svc", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "5af143afdbf58ec11ab3b3d53dd4e5e3", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "IDSyncDaemon", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "5b270b309ad8c6478586a15dece20a88", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "java", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "5c1c89f930122bccc7a97d52f73bea2c", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "hola_svc", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "5cfbaea088a6084eefed5c5e8c3972ec", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "GNU Wget (observed 2026-07-31)", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "5d7abe53ae15b4272a34f10431e06bf3", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "java", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "5ee1a653fb824db7182714897fd3b5df", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "Citrix Viewer", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "5f9b53f0d39dc9d940a3b5568fe5f0bb", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "java,JavaApplicationStub", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "6003b52942a2e1e1ea72d802d153ec08", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "Amazon Music", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "61d50e7771aee7f2f4b89a7200b4d45e", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "AcroCEF", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "62448833d8230241227c03b7d441e31b", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "parsecd,apple.geod,apple.photomoments,photoanalysisd,FreedomProxy", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "641df9d6dbe7fdb74f70c8ad93def8cc", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "node.js", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "6acb250ada693067812c3335705dae79", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "mono-sgen,Syncplicity,Axure RP 8,Amazon Drive", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "77310efe11f1943306ee317cf02150b7", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "hola_svc", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "7c7a68b96d2aab15d678497a12119f4f", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "java", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "83e04bc58d402f9633983cbf22724b02", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "Charles,Google Play Music Desktop Player,Postman,Slack,and other desktop programs", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "84071ea96fc8a60c55fc8a405e214c0f", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "Used by many desktop apps,Quip,Spotify,GitHub Desktop", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "844166382cc98d98595e6778c470f5d5", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "Salesforce Files", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "84607748f3887541dd60fe974a042c71", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "wineserver", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "88afa0dea1608e28f50acbad32d7f195", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "java", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "88f1fd7a4ad8bf2abd56176f5455424b", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "OpenSSL s_client (observed 2026-07-31)", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "8bd59c4b7f3193db80fd64318429bcec", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "hola_svc", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "8c5a50f1e833ed581e9cfc690814719a", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "eclipse,JavaApplicationStub,idea", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "8ce6933b8c12ce931ca238e9420cc5dd", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "java", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "8e3f1bf87bc652a20de63bfd4952b16a", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "AnypointStudio", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "900c1fa84b4ea86537e1d148ee16eae8", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "Fuze", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "9811c1bb9f0f6835d5c13a831cca4173", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "node.js", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "a585c632a2b49be1256881fb0c16c864", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "Tableau", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "a5aa6e939e4770e3b8ac38ce414fd0d5", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "Slack", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "a61299f9b501adcf680b9275d79d4ac6", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "java", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "a7823092705a5e91ce2b7f561b6e5b98", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "Qsync Client", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "a9d17f74e55dd53fcf7c234f8a240919", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "Covenant Eyes", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "a9fead344bf3ac09f62df3cd9b22c268", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "java", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "ae340571b4fd0755c4a0821b18d8fa93", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "Google Earth", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "ba40fea2b2638908a3b3b482ac78d729", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "apple.geod,parsecd,apple.photomoments", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "bc0608d33dc64506b42f7f5f87958f37", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "cscan", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "be9f1360cf52dc1f61ae025252f192a3", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "Chromium", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "c048d9f26a79e11ca7276499ef24daf3", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "RescueTime,Plantronics Hub", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "c2b4710c6888a5d47befe865c8e6fb19", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "ZwiftApp", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "c376061f96329e1020865a1dc726927d", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "JavaApplicationStub", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "c46941d4de99445aef6b497679474cf4", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "geod", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "c5c11e6105c56fd29cc72c3ac7a2b78b", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "AT&T Connect", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "c882d9444412c00e71b643f3f54145ff", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "Creative Cloud", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "c9dbeed362a32f9a50a26f4d9b32bbd8", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "Messenger,Jumpshare", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "ccaa60f6ccc701bde536ef409be3cf63", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "curl no-SNI", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "cd7c06b9459c9cfd4af2dba5696ea930", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "Tableau", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "cdec81515ccc75a5aa41eb3db22226e6", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "BlueJeans,CEPHtmlEngine", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "d06acbe8ac31e753f40600a9d6717cba", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "Inbox OSX", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "d1f9f9b224387d2597f02095fcec96d7", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "hola_svc", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "d219efd07cbb8fbe547e6a5335843f0f", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "ruby", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "d27fb8deca6e3b9739db3fda2b229fe3", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "Google Drive File Stream", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "d732ca39155f38942f90e9fc2b0f97f7", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "Maxthon", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "d74778f454e2b047e030b291b94dd698", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "eclipse,java", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "def8761e4bcaaf91d99801a22ac6f6d4", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "Chromium", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "df65746370dcabc9b4f370c6e14a8156", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "True Key", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "e0224fc1c33658f2d3d963bfb0a76a85", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "Viber", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "e516ad69a423f8e0407307aa7bfd6344", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "Kindle,stack,nextcloud", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "e7d46c98b078477c4324031e0d3b22f5", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "Cisco AnyConnect Secure Mobility Client", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "e846898acc767ebeb2b4388e58a968d4", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "postbox-bin", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "eb149984fc9c44d85ed7f12c90d818be", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "Amazon Music,Dreamweaver,Spotify", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "ed36017db541879619c399c95e22067d", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "Cisco AnyConnect Secure Mobility Client", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "f059212ce3de94b1e8253a7522cb1b44", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "Google Photos Backup", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "f22bdd57e3a52de86cda40da2d84e83b", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "java,eclipse,Cyberduck", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "f28d34ce9e732f644de2350027d74c3f", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "Used by many programs,Quip,Aura,Spotify,Chatty", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "f6fd83a21f9f3c5f9ff7b5c63bbc179d", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "Alation Compose", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "f753495f2eab5155c61b760c838018f8", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "apple.geod", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "fa030dbcb2e3c7141d3c2803780ee8db", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "Battle.net,Dropbox", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "fa106fe5beec443af7e211ef8902e7e0", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "eclipse", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "fc5cb0985a5f5e295163cc8ffff8a6e1", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "Chromium", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "fd10cc8cce9493a966c57249e074755f", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "gramblr", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "fe048fe8faf797796e278f2b4f1e9c24", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "curl SNI", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "ff1040ba1e3d235855ef0d7cd9237fdc", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "hola_svc", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "002205d0f96c37c5e660b9f041363c11", "kind": "ja3", "tier": "curated", "classification": "browser", "description": "Google Chrome", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "073eede15b2a5a0302d823ecbd5ad15b", "kind": "ja3", "tier": "curated", "classification": "browser", "description": "Google Chrome", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "07b4162d4db57554961824a21c4a0fde", "kind": "ja3", "tier": "curated", "classification": "browser", "description": "firefox,thunderbird", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "0a81538cf247c104edb677bdb8902ed5", "kind": "ja3", "tier": "curated", "classification": "browser", "description": "firefox", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "0b61c673ee71fe9ee725bd687c455809", "kind": "ja3", "tier": "curated", "classification": "browser", "description": "Google Chrome", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "0b6592fd91d4843c823b75e49b43838d", "kind": "ja3", "tier": "curated", "classification": "browser", "description": "firefox", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "0e46737668fe75092919ee047a0b5945", "kind": "ja3", "tier": "curated", "classification": "browser", "description": "Google Chrome Helper", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "0ffee3ba8e615ad22535e7f771690a28", "kind": "ja3", "tier": "curated", "classification": "browser", "description": "firefox", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "1c15aca4a38bad90f9c40678f6aface9", "kind": "ja3", "tier": "curated", "classification": "browser", "description": "firefox", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "20dd18bdd3209ea718989030a6f93364", "kind": "ja3", "tier": "curated", "classification": "browser", "description": "Used by many programs,Slack,Postman,Spotify,Google Chrome", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "39fa85654105398ee7ef6a3a1c81d685", "kind": "ja3", "tier": "curated", "classification": "browser", "description": "Google Chrome Helper", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "3e4e87dda5a3162306609b7e330441d2", "kind": "ja3", "tier": "curated", "classification": "browser", "description": "apple.WebKit.Networking,itunesstored", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "3ee4aaac7147ff2b80ada31686db660c", "kind": "ja3", "tier": "curated", "classification": "browser", "description": "node-webkit,Kindle", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "40fd0a5e81ebdcf0ec82a4710a12dec1", "kind": "ja3", "tier": "curated", "classification": "browser", "description": "Used by many programs on OSX,apple.WebKit.Networking", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "474e73aea21d1e0910f25c3e6c178535", "kind": "ja3", "tier": "curated", "classification": "browser", "description": "apple.WebKit.Networking", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "4ba7b7022f5f5e1e500bb19199d8b1a4", "kind": "ja3", "tier": "curated", "classification": "browser", "description": "Google Chrome Helper", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "4c40bf8baa7c301c5dba8a20bc4119e2", "kind": "ja3", "tier": "curated", "classification": "browser", "description": "Dynalist,Postman,Google Chrome,Franz,GOG Galaxy", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "5163bc7c08f57077bc652ec370459c2f", "kind": "ja3", "tier": "curated", "classification": "browser", "description": "firefox", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "5498cef2cca704eb01cf2041cc1089c1", "kind": "ja3", "tier": "curated", "classification": "browser", "description": "Google Chrome,Slack", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "618ee2509ef52bf0b8216e1564eea909", "kind": "ja3", "tier": "curated", "classification": "browser", "description": "Used by many programs on OSX,apple.WebKit.Networking", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "61d0d709fe7ac199ef4b2c52bc8cef75", "kind": "ja3", "tier": "curated", "classification": "browser", "description": "firefox,thunderbird", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "63de2b6188d5694e79b678f585b13264", "kind": "ja3", "tier": "curated", "classification": "browser", "description": "apple.WebKit.Networking,Chatter,FieldServiceApp,socialstudio", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "6cd1b944f5885e2cfbe98a840b75eeb8", "kind": "ja3", "tier": "curated", "classification": "browser", "description": "Google Chrome", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "799135475da362592a4be9199d258726", "kind": "ja3", "tier": "curated", "classification": "browser", "description": "Used by many programs on OSX,apple.WebKit.Networking", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "7b343af1092863fdd822d6f10645abfb", "kind": "ja3", "tier": "curated", "classification": "browser", "description": "apple.WebKit.Networking,itunesstored", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "7b530a25af9016a9d12de5abc54d9e74", "kind": "ja3", "tier": "curated", "classification": "browser", "description": "Used by many programs on OSX,apple.WebKit.Networking", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "7e72698146290dd68239f788a452e7d8", "kind": "ja3", "tier": "curated", "classification": "browser", "description": "Used by many programs on OSX,apple.WebKit.Networking", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "8498fe4268764dbf926a38283e9d3d8f", "kind": "ja3", "tier": "curated", "classification": "browser", "description": "Franz,Google Chrome,Kiwi,Spotify,nwjs,Slack", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "8db4b0f8e9dd8f2fff38ee7c5a1e4496", "kind": "ja3", "tier": "curated", "classification": "browser", "description": "SpotlightNetHelper,Safari", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "94c485bca29d5392be53f2b8cf7f4304", "kind": "ja3", "tier": "curated", "classification": "browser", "description": "Google Chrome", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "a312f9162a08eeedf7feb7a13cd7e9bb", "kind": "ja3", "tier": "curated", "classification": "browser", "description": "apple.WebKit.Networking,Spotify,WhatsApp,Skype,iTunes", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "a88f1426c4603f2a8cd8bb41e875cb75", "kind": "ja3", "tier": "curated", "classification": "browser", "description": "firefox", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "a9aecaa66ad9c6cfe1c361da31768506", "kind": "ja3", "tier": "curated", "classification": "browser", "description": "Used by many programs on OSX,apple.WebKit.Networking", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "b03910cc6de801d2fcfa0c3b9f397df4", "kind": "ja3", "tier": "curated", "classification": "browser", "description": "firefox", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "b4f4e6164f938870486578536fc1ffce", "kind": "ja3", "tier": "curated", "classification": "browser", "description": "Google Chrome", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "b8f81673c0e1d29908346f3bab892b9b", "kind": "ja3", "tier": "curated", "classification": "browser", "description": "Google Chrome", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "baaac9b6bf25ad098115c71c59d29e51", "kind": "ja3", "tier": "curated", "classification": "browser", "description": "Google Chrome", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "bc6c386f480ee97b9d9e52d472b772d8", "kind": "ja3", "tier": "curated", "classification": "browser", "description": "Google Chrome", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "bfcc1a3891601edb4f137ab7ab25b840", "kind": "ja3", "tier": "curated", "classification": "browser", "description": "firefox", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "c05de18b01a054f2f6900ffe96b3da7a", "kind": "ja3", "tier": "curated", "classification": "browser", "description": "Used by many programs on OSX,apple.WebKit.Networking", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "c07cb55f88702033a8f52c046d23e0b2", "kind": "ja3", "tier": "curated", "classification": "browser", "description": "Used by many programs on OSX,apple.WebKit.Networking", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "c36fb08942cf19508c08d96af22d4ffc", "kind": "ja3", "tier": "curated", "classification": "browser", "description": "Safari", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "ce694315cbb81ce95e6ae4ae8cbafde6", "kind": "ja3", "tier": "curated", "classification": "browser", "description": "firefox", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "d4693422c5ce1565377aca25940ad80c", "kind": "ja3", "tier": "curated", "classification": "browser", "description": "apple.WebKit.Networking,CalendarAgent,Go for Gmail", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "da949afd9bd6df820730f8f171584a71", "kind": "ja3", "tier": "curated", "classification": "browser", "description": "Google Chrome", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "e4d448cdfe06dc1243c1eb026c74ac9a", "kind": "ja3", "tier": "curated", "classification": "browser", "description": "Used by many programs on OSX,apple.WebKit.Networking", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "eeeb5e7485f5e10cbc39db4cfb69b264", "kind": "ja3", "tier": "curated", "classification": "browser", "description": "apple.WebKit.Networking", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "f15797a734d0b4f171a86fd35c9a5e43", "kind": "ja3", "tier": "curated", "classification": "browser", "description": "firefox", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "f1c5cf087b959cec31bd6285407f689a", "kind": "ja3", "tier": "curated", "classification": "browser", "description": "Used by many programs on OSX,apple.WebKit.Networking", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "f58966d34ff9488a83797b55c804724d", "kind": "ja3", "tier": "curated", "classification": "browser", "description": "Google Chrome", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "fd6314b03413399e4f23d1524d206692", "kind": "ja3", "tier": "curated", "classification": "browser", "description": "Google Chrome", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "t10d640300_13a2a23d501b_6bf8f498b543", "kind": "ja4", "tier": "curated", "classification": "scanner", "description": "nmap ssl-enum-ciphers, JA4 (stable across runs; observed 2026-07-31)", "ja4": { "a": "t10d640300", "b": "13a2a23d501b", "c": "6bf8f498b543", "properties": { "transport": "TCP", "tls_version": "TLS 1.0", "sni": "server name sent", "cipher_count": 64, "extension_count": 3, "alpn": null } }, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "t10d640300_67f0ca237a44_6bf8f498b543", "kind": "ja4", "tier": "curated", "classification": "scanner", "description": "nmap ssl-enum-ciphers, JA4 (stable across runs; observed 2026-07-31)", "ja4": { "a": "t10d640300", "b": "67f0ca237a44", "c": "6bf8f498b543", "properties": { "transport": "TCP", "tls_version": "TLS 1.0", "sni": "server name sent", "cipher_count": 64, "extension_count": 3, "alpn": null } }, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "t10d640300_a3acda31d846_6bf8f498b543", "kind": "ja4", "tier": "curated", "classification": "scanner", "description": "nmap ssl-enum-ciphers, JA4 (stable across runs; observed 2026-07-31)", "ja4": { "a": "t10d640300", "b": "a3acda31d846", "c": "6bf8f498b543", "properties": { "transport": "TCP", "tls_version": "TLS 1.0", "sni": "server name sent", "cipher_count": 64, "extension_count": 3, "alpn": null } }, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "t10d640300_e31a90cd0803_6bf8f498b543", "kind": "ja4", "tier": "curated", "classification": "scanner", "description": "nmap ssl-enum-ciphers, JA4 (stable across runs; observed 2026-07-31)", "ja4": { "a": "t10d640300", "b": "e31a90cd0803", "c": "6bf8f498b543", "properties": { "transport": "TCP", "tls_version": "TLS 1.0", "sni": "server name sent", "cipher_count": 64, "extension_count": 3, "alpn": null } }, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "t10d640300_e7b476f9520b_6bf8f498b543", "kind": "ja4", "tier": "curated", "classification": "scanner", "description": "nmap ssl-enum-ciphers, JA4 (stable across runs; observed 2026-07-31)", "ja4": { "a": "t10d640300", "b": "e7b476f9520b", "c": "6bf8f498b543", "properties": { "transport": "TCP", "tls_version": "TLS 1.0", "sni": "server name sent", "cipher_count": 64, "extension_count": 3, "alpn": null } }, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "t10d640300_f559eb9565fd_6bf8f498b543", "kind": "ja4", "tier": "curated", "classification": "scanner", "description": "nmap ssl-enum-ciphers, JA4 (stable across runs; observed 2026-07-31)", "ja4": { "a": "t10d640300", "b": "f559eb9565fd", "c": "6bf8f498b543", "properties": { "transport": "TCP", "tls_version": "TLS 1.0", "sni": "server name sent", "cipher_count": 64, "extension_count": 3, "alpn": null } }, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "t11d640300_13a2a23d501b_6bf8f498b543", "kind": "ja4", "tier": "curated", "classification": "scanner", "description": "nmap ssl-enum-ciphers, JA4 (stable across runs; observed 2026-07-31)", "ja4": { "a": "t11d640300", "b": "13a2a23d501b", "c": "6bf8f498b543", "properties": { "transport": "TCP", "tls_version": "TLS 1.1", "sni": "server name sent", "cipher_count": 64, "extension_count": 3, "alpn": null } }, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "t11d640300_67f0ca237a44_6bf8f498b543", "kind": "ja4", "tier": "curated", "classification": "scanner", "description": "nmap ssl-enum-ciphers, JA4 (stable across runs; observed 2026-07-31)", "ja4": { "a": "t11d640300", "b": "67f0ca237a44", "c": "6bf8f498b543", "properties": { "transport": "TCP", "tls_version": "TLS 1.1", "sni": "server name sent", "cipher_count": 64, "extension_count": 3, "alpn": null } }, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "t11d640300_a3acda31d846_6bf8f498b543", "kind": "ja4", "tier": "curated", "classification": "scanner", "description": "nmap ssl-enum-ciphers, JA4 (stable across runs; observed 2026-07-31)", "ja4": { "a": "t11d640300", "b": "a3acda31d846", "c": "6bf8f498b543", "properties": { "transport": "TCP", "tls_version": "TLS 1.1", "sni": "server name sent", "cipher_count": 64, "extension_count": 3, "alpn": null } }, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "t11d640300_e31a90cd0803_6bf8f498b543", "kind": "ja4", "tier": "curated", "classification": "scanner", "description": "nmap ssl-enum-ciphers, JA4 (stable across runs; observed 2026-07-31)", "ja4": { "a": "t11d640300", "b": "e31a90cd0803", "c": "6bf8f498b543", "properties": { "transport": "TCP", "tls_version": "TLS 1.1", "sni": "server name sent", "cipher_count": 64, "extension_count": 3, "alpn": null } }, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "t11d640300_e7b476f9520b_6bf8f498b543", "kind": "ja4", "tier": "curated", "classification": "scanner", "description": "nmap ssl-enum-ciphers, JA4 (stable across runs; observed 2026-07-31)", "ja4": { "a": "t11d640300", "b": "e7b476f9520b", "c": "6bf8f498b543", "properties": { "transport": "TCP", "tls_version": "TLS 1.1", "sni": "server name sent", "cipher_count": 64, "extension_count": 3, "alpn": null } }, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "t11d640300_f559eb9565fd_6bf8f498b543", "kind": "ja4", "tier": "curated", "classification": "scanner", "description": "nmap ssl-enum-ciphers, JA4 (stable across runs; observed 2026-07-31)", "ja4": { "a": "t11d640300", "b": "f559eb9565fd", "c": "6bf8f498b543", "properties": { "transport": "TCP", "tls_version": "TLS 1.1", "sni": "server name sent", "cipher_count": 64, "extension_count": 3, "alpn": null } }, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "t12d190600_9c2f387b437f_82b0993b6ad8", "kind": "ja4", "tier": "curated", "classification": "scanner", "description": "nmap ssl-enum-ciphers, JA4 (stable across runs; observed 2026-07-31)", "ja4": { "a": "t12d190600", "b": "9c2f387b437f", "c": "82b0993b6ad8", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 19, "extension_count": 6, "alpn": null } }, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "t12d640400_13a2a23d501b_3549fbaf615c", "kind": "ja4", "tier": "curated", "classification": "scanner", "description": "nmap ssl-enum-ciphers, JA4 (stable across runs; observed 2026-07-31)", "ja4": { "a": "t12d640400", "b": "13a2a23d501b", "c": "3549fbaf615c", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 64, "extension_count": 4, "alpn": null } }, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "t12d640400_67f0ca237a44_3549fbaf615c", "kind": "ja4", "tier": "curated", "classification": "scanner", "description": "nmap ssl-enum-ciphers, JA4 (stable across runs; observed 2026-07-31)", "ja4": { "a": "t12d640400", "b": "67f0ca237a44", "c": "3549fbaf615c", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 64, "extension_count": 4, "alpn": null } }, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "t12d640400_a3acda31d846_3549fbaf615c", "kind": "ja4", "tier": "curated", "classification": "scanner", "description": "nmap ssl-enum-ciphers, JA4 (stable across runs; observed 2026-07-31)", "ja4": { "a": "t12d640400", "b": "a3acda31d846", "c": "3549fbaf615c", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 64, "extension_count": 4, "alpn": null } }, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "t12d640400_e31a90cd0803_3549fbaf615c", "kind": "ja4", "tier": "curated", "classification": "scanner", "description": "nmap ssl-enum-ciphers, JA4 (stable across runs; observed 2026-07-31)", "ja4": { "a": "t12d640400", "b": "e31a90cd0803", "c": "3549fbaf615c", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 64, "extension_count": 4, "alpn": null } }, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "t12d640400_e7b476f9520b_3549fbaf615c", "kind": "ja4", "tier": "curated", "classification": "scanner", "description": "nmap ssl-enum-ciphers, JA4 (stable across runs; observed 2026-07-31)", "ja4": { "a": "t12d640400", "b": "e7b476f9520b", "c": "3549fbaf615c", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 64, "extension_count": 4, "alpn": null } }, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "t12d640400_f559eb9565fd_3549fbaf615c", "kind": "ja4", "tier": "curated", "classification": "scanner", "description": "nmap ssl-enum-ciphers, JA4 (stable across runs; observed 2026-07-31)", "ja4": { "a": "t12d640400", "b": "f559eb9565fd", "c": "3549fbaf615c", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 64, "extension_count": 4, "alpn": null } }, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "t13d1312h2_f57a46bbacb6_36b6e4cc52f5", "kind": "ja4", "tier": "observed", "classification": "api_client", "description": "Go net/http \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1312h2", "b": "f57a46bbacb6", "c": "36b6e4cc52f5", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 13, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-4865-4866-4867,0-11-65281-23-18-5-10-13-50-16-43-51,4588-29-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 50, "name": "signature_algorithms_cert", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 4, "first_seen": 1787451402, "last_seen": 1787451404, "transport": "t", "ja3_hash": "e69402f870ecf542b4f017b0ed32936a", "user_agents": { "Go-http-client/2.0": 8 } } }, { "hash": "t13d1313h2_f57a46bbacb6_02fd2181c59f", "kind": "ja4", "tier": "observed", "classification": "api_client", "description": "Go net/http \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1313h2", "b": "f57a46bbacb6", "c": "02fd2181c59f", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 13, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-4865-4866-4867,0-11-35-65281-23-18-5-10-13-16-43-51-45,25497-29-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true } ], "curves": [ { "value": 25497, "name": "X25519Kyber768Draft00", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1787460093, "last_seen": 1787460093, "transport": "t", "ja3_hash": "d3516fb149c297df8b9e80e3d0471e6b", "user_agents": { "Go-http-client/2.0": 1 } } }, { "hash": "t13d1713ht_ab0a1bf427ad_23c7dd8c4d5c", "kind": "ja4", "tier": "observed", "classification": "api_client", "description": "Python requests \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1713ht", "b": "ab0a1bf427ad", "c": "23c7dd8c4d5c", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 17, "extension_count": 13, "alpn": "ht" } }, "ja3_string": "771,4866-4867-4865-49196-49200-49195-49199-52393-52392-49188-49192-49187-49191-159-158-107-103,65281-0-11-10-16-22-23-49-13-43-45-51-27,4588-29-23-30-24-25-256-257,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 49, "name": "post_handshake_auth", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 27, "name": "compress_certificate", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 2, "first_seen": 1787444807, "last_seen": 1787456459, "transport": "t", "ja3_hash": "86dab2109182b6bbaa644647d7db2997", "user_agents": { "python-requests/2.33.1": 1 } } }, { "hash": "t13d3013h2_1d37bd780c83_23c7dd8c4d5c", "kind": "ja4", "tier": "observed", "classification": "api_client", "description": "Seen in live traffic; not in the curated database.", "ja4": { "a": "t13d3013h2", "b": "1d37bd780c83", "c": "23c7dd8c4d5c", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 30, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4866-4867-4865-49196-49200-159-52393-52392-52394-49195-49199-158-49188-49192-107-49187-49191-103-49162-49172-57-49161-49171-51-157-156-61-60-53-47,65281-0-11-10-16-22-23-49-13-43-45-51-27,4588-29-23-30-24-25-256-257,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 49, "name": "post_handshake_auth", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 27, "name": "compress_certificate", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 65, "first_seen": 1787442806, "last_seen": 1787461696, "transport": "t", "ja3_hash": "32e4b8812cda0c0d50783b438492a769", "user_agents": { "pqcrypta-ip-update/1.0 (us-midwest heartbeat)": 34 } } }, { "hash": "t13d3110h2_e8f1e7e78f70_7d9922609cc6", "kind": "ja4", "tier": "observed", "classification": "api_client", "description": "curl \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d3110h2", "b": "e8f1e7e78f70", "c": "7d9922609cc6", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 31, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4866-4867-4865-49196-49200-159-52393-52392-52394-49195-49199-158-49188-49192-107-49187-49191-103-49162-49172-57-49161-49171-51-157-156-61-60-53-47-255,0-10-16-22-23-49-13-43-45-51,4588,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 49, "name": "post_handshake_auth", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true } ], "point_formats": [] }, "observed": { "count": 4, "first_seen": 1787442722, "last_seen": 1787453388, "transport": "t", "ja3_hash": "b1aee0d60817694c5c3337dcf344c3fa", "user_agents": { "curl/8.18.0-DEV": 1 } } }, { "hash": "t13i1311h2_f57a46bbacb6_d86ca3cca451", "kind": "ja4", "tier": "observed", "classification": "api_client", "description": "curl \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1311h2", "b": "f57a46bbacb6", "c": "d86ca3cca451", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 13, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-4865-4866-4867,11-65281-23-18-5-10-13-50-16-43-51,4588-29-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 50, "name": "signature_algorithms_cert", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1787461157, "last_seen": 1787461157, "transport": "t", "ja3_hash": "8c5b2f378e481f94b4f82c131798f4d4", "user_agents": { "curl/7.74.0": 1 } } }, { "hash": "q13d0311h3_55b375c5d22e_82b1eba68007", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "q13d0311h3", "b": "55b375c5d22e", "c": "82b1eba68007", "properties": { "transport": "QUIC", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 3, "extension_count": 11, "alpn": "h3" } }, "ja3_string": "771,4865-4866-4867,57-10-13-51-16-43-45-27-65037-0-17613,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true } ], "extensions": [ { "value": 57, "name": "quic_transport_parameters", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1787449882, "last_seen": 1787449882, "transport": "q", "ja3_hash": "a7b66897c118a19dd2d66d2a2ab8e9ae", "user_agents": [] } }, { "hash": "q13d0413h3_16476d049b0b_745ab6f97f32", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "q13d0413h3", "b": "16476d049b0b", "c": "745ab6f97f32", "properties": { "transport": "QUIC", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 4, "extension_count": 13, "alpn": "h3" } }, "ja3_string": "771,4866-4867-4865-255,0-11-10-16-22-23-49-13-43-45-51-57-21,29-23-30-25-24-256-257-258-259-260,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 49, "name": "post_handshake_auth", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 57, "name": "quic_transport_parameters", "known": true }, { "value": 21, "name": "padding", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true }, { "value": 258, "name": "ffdhe4096", "known": true }, { "value": 259, "name": "259 (0x0103)", "known": false }, { "value": 260, "name": "260 (0x0104)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 31, "first_seen": 1787442722, "last_seen": 1787461482, "transport": "q", "ja3_hash": "42125b8d3d7a27886a9600b9a38e8559", "user_agents": { "curl/8.18.0-DEV": 3, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36": 13, "Go-http-client/2.0": 3 } } }, { "hash": "t12i150200_8daaf6152771_c899f8114fe8", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150200", "b": "8daaf6152771", "c": "c899f8114fe8", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 2, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1787461484, "last_seen": 1787461484, "transport": "t", "ja3_hash": "9e1503afa013a12182c5d11ea5aa892a", "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 10 } } }, { "hash": "t12i150700_8daaf6152771_25b09a2db6f9", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150700", "b": "8daaf6152771", "c": "25b09a2db6f9", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-11-27-65037-17613-45-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1787461028, "last_seen": 1787461028, "transport": "t", "ja3_hash": "b8cf6a51b297aeb2264ee6db111115b8", "user_agents": { "Mozilla/5.0 (Linux; Android 6.0; Nexus 5 Build/MRA58N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.8791.1964 Mobile Safari/537.36": 1 } } }, { "hash": "t13d1011h2_61a7ad8aa9b6_861bc38b0be4", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1011h2", "b": "61a7ad8aa9b6", "c": "861bc38b0be4", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 10, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4866-4865-4867-49196-49195-52393-49200-49199-52392-255,43-51-23-35-45-10-16-5-11-0-13,29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1787459651, "last_seen": 1787459651, "transport": "t", "ja3_hash": "405c8cbfa0155a7476d28f92f31ac60e", "user_agents": { "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; GPTBot/1.4; +https://openai.com/gptbot)": 1 } } }, { "hash": "t13d1013h2_01be160bb49b_b9165cb4b096", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1013h2", "b": "01be160bb49b", "c": "b9165cb4b096", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 10, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4866-4865-49196-49195-49200-49199-49188-49187-49192-49191,0-5-43-13-35-10-11-16-51-49-23-65281-45,24-23,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 49, "name": "post_handshake_auth", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true } ], "curves": [ { "value": 24, "name": "secp384r1", "known": true }, { "value": 23, "name": "secp256r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 11, "first_seen": 1787455217, "last_seen": 1787455318, "transport": "t", "ja3_hash": "29a483aa2a7106f73d1228c2e68a3f84", "user_agents": { "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; bingbot/2.0; +http://www.bing.com/bingbot.htm) Chrome/136.0.0.0 Safari/537.36": 11 } } }, { "hash": "t13d131000_f57a46bbacb6_27f0a1fdd87d", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d131000", "b": "f57a46bbacb6", "c": "27f0a1fdd87d", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 13, "extension_count": 10, "alpn": null } }, "ja3_string": "771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-4865-4866-4867,0-11-65281-23-18-5-10-13-43-51,4588-29-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 35, "first_seen": 1787444214, "last_seen": 1787444221, "transport": "t", "ja3_hash": "9a382d25aa597efd92d217d84b6eca00", "user_agents": [] } }, { "hash": "t13d131100_f57a46bbacb6_4b7cee5f0569", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d131100", "b": "f57a46bbacb6", "c": "4b7cee5f0569", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 13, "extension_count": 11, "alpn": null } }, "ja3_string": "771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-4865-4866-4867,0-11-65281-23-18-5-10-13-50-43-51,4588-4587-4589-29-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 50, "name": "signature_algorithms_cert", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 4587, "name": "X25519MLKEM768", "known": true }, { "value": 4589, "name": "4589 (0x11ed)", "known": false }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 26, "first_seen": 1787443457, "last_seen": 1787461464, "transport": "t", "ja3_hash": "9b7dcdf3f997f1fb7b4409c94cb7ef36", "user_agents": { "Mozilla/5.0 (Linux; Android 7.0;) AppleWebKit/537.36 (HTML, like Gecko) Mobile Safari/537.36 (compatible; PetalBot;+https://webmaster.petalsearch.com/site/petalbot)": 12, "DuckDuckBot/1.1; (+http://duckduckgo.com/duckduckbot.html)": 4, "Mozilla/5.0 (compatible; YandexBot/3.0; +http://yandex.com/bots)": 7 } } }, { "hash": "t13d150400_8daaf6152771_db745f7197ad", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d150400", "b": "8daaf6152771", "c": "db745f7197ad", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-43-0-16,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1787454024, "last_seen": 1787454024, "transport": "t", "ja3_hash": "ea38c450f64cc37e771ce317928c7656", "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36": 13 } } }, { "hash": "t13d1512h2_8daaf6152771_d786283522ca", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1512h2", "b": "8daaf6152771", "c": "d786283522ca", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4866-4867-4865-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-0-11-10-35-5-16-23-13-43-45-51,4588-29-23-30-24-25-256-257,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 2, "first_seen": 1787454872, "last_seen": 1787454873, "transport": "t", "ja3_hash": "bf57dec2e7a00870764f29e4d2e5a521", "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36 Edg/151.0.0.0": 50 } } }, { "hash": "t13d1515h2_8daaf6152771_f1525dfe0d74", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1515h2", "b": "8daaf6152771", "c": "f1525dfe0d74", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 15, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-5-65037-18-43-16-35-13-45-27-0-10-11-23-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1787460547, "last_seen": 1787460547, "transport": "t", "ja3_hash": "3a0c2679d8b81f5ac47a379e70ebd7b4", "user_agents": { "Mozilla/5.0 (Linux; Android 8.0; Pixel 2 Build/OPD3.170816.012) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/55.0.1667.1295 Mobile Safari/537.36": 1 } } }, { "hash": "t13d1516h2_8daaf6152771_a7826127fcf8", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Seen in live traffic; not in the curated database.", "ja4": { "a": "t13d1516h2", "b": "8daaf6152771", "c": "a7826127fcf8", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 16, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-23-65281-10-11-35-16-5-13-18-51-45-43-27-17513-21,29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 17513, "name": "application_settings", "known": true }, { "value": 21, "name": "padding", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 2, "first_seen": 1787444170, "last_seen": 1787456045, "transport": "t", "ja3_hash": "cd08e31494f9531f560d64c695473da9", "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36": 2 } } }, { "hash": "t13d1517h2_8daaf6152771_7e6e16c20c5c", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1517h2", "b": "8daaf6152771", "c": "7e6e16c20c5c", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 17, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-17513-43-51-18-16-27-45-0-65281-5-10-35-11-23-65037-21,29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 17513, "name": "application_settings", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 21, "name": "padding", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1787455621, "last_seen": 1787455621, "transport": "t", "ja3_hash": "4dedc6da3cc34fbd89116e8d492960cd", "user_agents": [] } }, { "hash": "t13d1517h2_8daaf6152771_a816eaafa7a8", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1517h2", "b": "8daaf6152771", "c": "a816eaafa7a8", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 17, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-16-35-18-17613-65281-5-23-51-27-11-45-10-0-43-13-41,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 41, "name": "pre_shared_key", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1787447468, "last_seen": 1787447468, "transport": "t", "ja3_hash": "b50028e18a9da1d348a3034a8246b036", "user_agents": [] } }, { "hash": "t13d1517h2_8daaf6152771_c80cf1d07396", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1517h2", "b": "8daaf6152771", "c": "c80cf1d07396", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 17, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-45-0-16-23-65281-51-5-27-65037-10-18-35-13-43-11-41,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 41, "name": "pre_shared_key", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1787452351, "last_seen": 1787452351, "transport": "t", "ja3_hash": "40017018db3327229fe91056d8aa4789", "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36": 4 } } }, { "hash": "t13d1617h2_86a278354501_7af0cb3b5dda", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Firefox \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1617h2", "b": "86a278354501", "c": "7af0cb3b5dda", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 16, "extension_count": 17, "alpn": "h2" } }, "ja3_string": "771,4865-4867-4866-49195-49199-52393-52392-49196-49200-49162-49171-49172-156-157-47-53,0-23-65281-10-11-35-16-5-34-18-51-43-13-45-28-27-65037,4588-29-23-24-25-256-257,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 34, "name": "34 (0x0022)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 28, "name": "record_size_limit", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1787459609, "last_seen": 1787459609, "transport": "t", "ja3_hash": "6447ab086255d194909d4013b1a89e87", "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:152.0) Gecko/20100101 Firefox/152.0": 18 } } }, { "hash": "t13d1713ht_ab0a1bf427ad_99c94103f5e0", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1713ht", "b": "ab0a1bf427ad", "c": "99c94103f5e0", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 17, "extension_count": 13, "alpn": "ht" } }, "ja3_string": "771,4866-4867-4865-49196-49200-49195-49199-52393-52392-49188-49192-49187-49191-159-158-107-103,65281-0-11-10-35-16-22-23-13-43-45-51-27,4588-29-23-30-24-25-256-257,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 27, "name": "compress_certificate", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 6, "first_seen": 1787443095, "last_seen": 1787461091, "transport": "t", "ja3_hash": "06873b563b993c62a40abbbdb28d2f21", "user_agents": { "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; YouBot/1.0; +https://docs.you.com/youbot; env:prod) Chrome/142.0.0.0 Safari/537.36": 5 } } }, { "hash": "t13d1717h2_5b57614c22b0_7af0cb3b5dda", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Firefox \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1717h2", "b": "5b57614c22b0", "c": "7af0cb3b5dda", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 17, "extension_count": 17, "alpn": "h2" } }, "ja3_string": "771,4865-4867-4866-49195-49199-52393-52392-49196-49200-49162-49161-49171-49172-156-157-47-53,0-23-65281-10-11-35-16-5-34-18-51-43-13-45-28-27-65037,4588-29-23-24-25-256-257,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 34, "name": "34 (0x0022)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 28, "name": "record_size_limit", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1787456804, "last_seen": 1787456804, "transport": "t", "ja3_hash": "6f7889b9fb1a62a9577e685c1fcfa919", "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:135.0) Gecko/20100101 Firefox/135.0": 1 } } }, { "hash": "t13d1812ht_85036bcba153_6c7c91134a62", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1812ht", "b": "85036bcba153", "c": "6c7c91134a62", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 18, "extension_count": 12, "alpn": "ht" } }, "ja3_string": "771,4866-4867-4865-49196-49200-49195-49199-52393-52392-49188-49192-49187-49191-159-158-107-103-255,0-11-10-35-16-22-23-13-43-45-51-21,29-23-30-25-24-256-257-258-259-260,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 21, "name": "padding", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true }, { "value": 258, "name": "ffdhe4096", "known": true }, { "value": 259, "name": "259 (0x0103)", "known": false }, { "value": 260, "name": "260 (0x0104)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 7, "first_seen": 1787445860, "last_seen": 1787461142, "transport": "t", "ja3_hash": "304734bb1c086c3453b387400cf83f11", "user_agents": { "Mozilla/5.0 (compatible; SectorBot/1.0; +https://serdartorun.dev/bot) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124 Safari/537.36": 6 } } }, { "hash": "t13d181300_e8a523a41297_184ca06a0196", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d181300", "b": "e8a523a41297", "c": "184ca06a0196", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 18, "extension_count": 13, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-52393-52392-49196-49200-49161-49171-49162-49172-156-157-47-53-10,0-23-65281-10-11-35-5-13-18-51-45-43-21,29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 21, "name": "padding", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 185, "first_seen": 1787442682, "last_seen": 1787461686, "transport": "t", "ja3_hash": "b4da7f95e46bf2cf5285fd609cf726e4", "user_agents": { "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)": 15, "Mozilla/5.0 (Linux; Android 6.0.1; Nexus 5X Build/MMB29P) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.7922.137 Mobile Safari/537.36 (compatible; GoogleOther)": 86, "Mozilla/5.0 (Linux; Android 6.0.1; Nexus 5X Build/MMB29P) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.7922.137 Mobile Safari/537.36 (compatible; Googlebot/2.1; +http://www.": 110 } } }, { "hash": "t13d190900_9dc949149365_a38838ecc1fa", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d190900", "b": "9dc949149365", "c": "a38838ecc1fa", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 19, "extension_count": 9, "alpn": null } }, "ja3_string": "771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-156-157-47-53-49170-10-4865-4866-4867,0-5-10-11-13-65281-18-43-51,29-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 11, "first_seen": 1787445462, "last_seen": 1787455603, "transport": "t", "ja3_hash": "473cd7cb9faa642487833865d516e578", "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_2) AppleWebKit/537.4 (KHTML like Gecko) Chrome/22.0.1229.79 Safari/537.4": 1 } } }, { "hash": "t13d1912h2_9dc949149365_b246ff971066", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1912h2", "b": "9dc949149365", "c": "b246ff971066", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 19, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-156-157-47-53-49170-10-4865-4866-4867,0-11-65281-23-18-5-10-13-50-16-43-51,29-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 50, "name": "signature_algorithms_cert", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1787458560, "last_seen": 1787458560, "transport": "t", "ja3_hash": "d113e8b9d55b97b77077806180483c96", "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.124 Safari/537.36": 1 } } }, { "hash": "t13d191300_9dc949149365_db66201a557f", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d191300", "b": "9dc949149365", "c": "db66201a557f", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 19, "extension_count": 13, "alpn": null } }, "ja3_string": "771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-156-157-47-53-49170-10-4865-4866-4867,0-11-35-65281-23-18-5-10-13-50-43-51-45,29-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 50, "name": "signature_algorithms_cert", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 8, "first_seen": 1787448861, "last_seen": 1787450669, "transport": "t", "ja3_hash": "3166f9c5e6b0e72f283dc10e6f23f345", "user_agents": { "Mozilla/5.0 (Linux; Android 7.0; SM-G892A Bulid/NRD90M; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/60.0.3112.107 Moblie Safari/537.36": 2, "Mozlila/5.0 (Linux; Android 7.0; SM-G892A Bulid/NRD90M; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/60.0.3112.107 Moblie Safari/537.36": 5 } } }, { "hash": "t13d201100_2b729b4bf6f3_2b2467513d7e", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d201100", "b": "2b729b4bf6f3", "c": "2b2467513d7e", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 20, "extension_count": 11, "alpn": null } }, "ja3_string": "771,4866-4865-49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47,0-43-13-35-10-11-51-49-23-65281-45,29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 49, "name": "post_handshake_auth", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 9, "first_seen": 1787442964, "last_seen": 1787457975, "transport": "t", "ja3_hash": "68b3ecfaf0034bb9fcbecd518b5ab8d4", "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36": 1 } } }, { "hash": "t13d2013h2_2b729b4bf6f3_b9165cb4b096", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d2013h2", "b": "2b729b4bf6f3", "c": "b9165cb4b096", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 20, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4866-4865-49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47,0-5-43-13-35-10-11-16-51-49-23-65281-45,24-23,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 49, "name": "post_handshake_auth", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true } ], "curves": [ { "value": 24, "name": "secp384r1", "known": true }, { "value": 23, "name": "secp256r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 6, "first_seen": 1787443170, "last_seen": 1787456125, "transport": "t", "ja3_hash": "d4ed3e50e6fccfcd0b8f2635bcec55ff", "user_agents": { "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; bingbot/2.0; +http://www.bing.com/bingbot.htm) Chrome/116.0.1938.76 Safari/537.36": 5 } } }, { "hash": "t13d2212h2_231e334592e8_a342e66d9b48", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d2212h2", "b": "231e334592e8", "c": "a342e66d9b48", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 22, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4866-4865-49196-49195-49200-49199-159-158-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47,0-43-13-35-10-11-16-51-49-23-65281-45,24-23,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 49, "name": "post_handshake_auth", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true } ], "curves": [ { "value": 24, "name": "secp384r1", "known": true }, { "value": 23, "name": "secp256r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 43, "first_seen": 1787443425, "last_seen": 1787460273, "transport": "t", "ja3_hash": "a1180b5557791f9d36d36739d0d9b08a", "user_agents": { "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; bingbot/2.0; +http://www.bing.com/bingbot.htm) Chrome/116.0.1938.76 Safari/537.36": 56, "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; bingbot/2.0; +http://www.bing.com/bingbot.htm) Chrome/136.0.0.0 Safari/537.36 AppleWebKit/537.36 (KHTML, like Gecko; ": 44 } } }, { "hash": "t13d2213h2_231e334592e8_05b94552854b", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d2213h2", "b": "231e334592e8", "c": "05b94552854b", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 22, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4866-4865-49196-49195-49200-49199-159-158-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47,0-43-13-35-10-11-16-51-49-23-65281-45-41,24-23,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 49, "name": "post_handshake_auth", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 41, "name": "pre_shared_key", "known": true } ], "curves": [ { "value": 24, "name": "secp384r1", "known": true }, { "value": 23, "name": "secp256r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 13, "first_seen": 1787454127, "last_seen": 1787454367, "transport": "t", "ja3_hash": "e073a34f05d77085eb938b316a570589", "user_agents": { "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; bingbot/2.0; +http://www.bing.com/bingbot.htm) Chrome/116.0.1938.76 Safari/537.36": 42, "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; bingbot/2.0; +http://www.bing.com/bingbot.htm) Chrome/136.0.0.0 Safari/537.36 AppleWebKit/537.36 (KHTML, like Gecko; ": 53 } } }, { "hash": "t13d2313ht_caaf12dcd773_6fab81fbbddb", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d2313ht", "b": "caaf12dcd773", "c": "6fab81fbbddb", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 23, "extension_count": 13, "alpn": "ht" } }, "ja3_string": "771,4866-4867-4865-49196-49200-159-52393-52392-52394-49195-49199-158-49188-49192-107-49187-49191-103-157-156-61-60-255,0-11-10-13172-16-22-23-49-13-43-45-51-21,29-23-30-25-24-256-257-258-259-260,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13172, "name": "13172 (0x3374)", "known": false }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 49, "name": "post_handshake_auth", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 21, "name": "padding", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true }, { "value": 258, "name": "ffdhe4096", "known": true }, { "value": 259, "name": "259 (0x0103)", "known": false }, { "value": 260, "name": "260 (0x0104)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 1, "first_seen": 1787460906, "last_seen": 1787460906, "transport": "t", "ja3_hash": "f7150f2d845f88a62358180aea27e4c2", "user_agents": { "Mozilla/5.0 (Linux; Android 17; SM-A205U) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.7871.126 Mobile Safari/537.36": 1 } } }, { "hash": "t13d251100_b78ed14e2fd0_4b7cee5f0569", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d251100", "b": "b78ed14e2fd0", "c": "4b7cee5f0569", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 25, "extension_count": 11, "alpn": null } }, "ja3_string": "771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-156-157-47-53-49170-10-49187-49191-60-49159-49169-5-4865-4866-4867,0-11-65281-23-18-5-10-13-50-43-51,4588-29-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49159, "name": "TLS_ECDHE_ECDSA_WITH_RC4_128_SHA", "known": true }, { "value": 49169, "name": "TLS_ECDHE_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 5, "name": "TLS_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 50, "name": "signature_algorithms_cert", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1787450490, "last_seen": 1787450490, "transport": "t", "ja3_hash": "238bcebdfa16aa0be417a7f7a80063a9", "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.1.2.3 Safari/537.36 Edg/121.0.623.86": 1 } } }, { "hash": "t13d2613h2_2802a3db6c62_87f4314a3231", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d2613h2", "b": "2802a3db6c62", "c": "87f4314a3231", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 26, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49196-49195-52393-49200-49199-52392-49188-49187-49162-49161-49192-49191-49172-49171-157-156-61-60-53-47-49160-49170-10,0-23-65281-10-11-16-5-13-18-51-45-43-21,29-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49160, "name": "TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 21, "name": "padding", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1787456801, "last_seen": 1787456801, "transport": "t", "ja3_hash": "656b9a2f4de6ed4909e157482860ab3d", "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/15.3 Safari/605.1.15": 1 } } }, { "hash": "t13d301000_1d37bd780c83_389a908827a0", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d301000", "b": "1d37bd780c83", "c": "389a908827a0", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 30, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4866-4867-4865-49196-49200-159-52393-52392-52394-49195-49199-158-49188-49192-107-49187-49191-103-49162-49172-57-49161-49171-51-157-156-61-60-53-47,65281-11-10-22-23-13-43-45-51-0,4588-4587-4590-29-23-30-24-25-41-256-257,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 0, "name": "server_name", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 4587, "name": "X25519MLKEM768", "known": true }, { "value": 4590, "name": "4590 (0x11ee)", "known": false }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 41, "name": "41 (0x0029)", "known": false }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1787454431, "last_seen": 1787454431, "transport": "t", "ja3_hash": "33ae362844509ccb28660da3cbfca03d", "user_agents": { "Mozilla/5.0 (X11; Linux aarch64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/139.0.0.0 Safari/537.36": 1 } } }, { "hash": "t13d3012h2_1d37bd780c83_be43a87a1363", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d3012h2", "b": "1d37bd780c83", "c": "be43a87a1363", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 30, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4866-4867-4865-49196-49200-159-52393-52392-52394-49195-49199-158-49188-49192-107-49187-49191-103-49162-49172-57-49161-49171-51-157-156-61-60-53-47,65281-0-11-10-16-22-23-49-13-43-45-51,4588-29-23-30-24-25-256-257,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 49, "name": "post_handshake_auth", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 34, "first_seen": 1787442715, "last_seen": 1787461377, "transport": "t", "ja3_hash": "446fb8bd613d17e5d44bd3b288ac94ca", "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 SecurityHeaders": 19, "pqcrypta-ip-update/1.0 (us-midwest heartbeat)": 1 } } }, { "hash": "t13d3012h2_1d37bd780c83_c4728683d87f", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d3012h2", "b": "1d37bd780c83", "c": "c4728683d87f", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 30, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4866-4867-4865-49196-49200-159-52393-52392-52394-49195-49199-158-49188-49192-107-49187-49191-103-49162-49172-57-49161-49171-51-157-156-61-60-53-47,65281-0-11-10-35-16-22-23-13-43-45-51,4588-29-23-30-24-25-256-257,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 2, "first_seen": 1787448618, "last_seen": 1787452210, "transport": "t", "ja3_hash": "bb4bfd0ec15f5be2c4225880b93a8b18", "user_agents": { "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; SleepBot/1.0; +http://sleepbot.com/) Chrome/131.0.0.0 Safari/537.36": 1 } } }, { "hash": "t13d311100_e8f1e7e78f70_cf86beea0419", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d311100", "b": "e8f1e7e78f70", "c": "cf86beea0419", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 31, "extension_count": 11, "alpn": null } }, "ja3_string": "771,4866-4867-4865-49196-49200-159-52393-52392-52394-49195-49199-158-49188-49192-107-49187-49191-103-49162-49172-57-49161-49171-51-157-156-61-60-53-47-255,0-11-10-35-22-23-13-43-45-51-21,29-23-30-25-24-256-257-258-259-260,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 21, "name": "padding", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true }, { "value": 258, "name": "ffdhe4096", "known": true }, { "value": 259, "name": "259 (0x0103)", "known": false }, { "value": 260, "name": "260 (0x0104)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 4, "first_seen": 1787445949, "last_seen": 1787453439, "transport": "t", "ja3_hash": "d39e1be3241d516b1f714bd47c2bc968", "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36": 3 } } }, { "hash": "t13d3111h2_e8f1e7e78f70_43244b3c42a3", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d3111h2", "b": "e8f1e7e78f70", "c": "43244b3c42a3", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 31, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4866-4867-4865-49196-49200-159-52393-52392-52394-49195-49199-158-49188-49192-107-49187-49191-103-49162-49172-57-49161-49171-51-157-156-61-60-53-47-255,0-11-10-35-16-22-23-13-43-45-51,29-23-30-25-24,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 18, "first_seen": 1787444785, "last_seen": 1787459313, "transport": "t", "ja3_hash": "1ce565f411fbc7412e3c5ba0bcfd62ab", "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 (compatible; meta-externalagent/1.1 (+https://developers.facebook.co": 4, "facebookexternalhit/1.1 (+http://www.facebook.com/externalhit_uatext.php)": 4, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 (compatible; meta-webindexer/1.1 (+https://developers.facebook.com/d": 1 } } }, { "hash": "t13d3612ht_018971650b2c_2b7f4d1bb443", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d3612ht", "b": "018971650b2c", "c": "2b7f4d1bb443", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 36, "extension_count": 12, "alpn": "ht" } }, "ja3_string": "771,4866-4867-4865-4868-49196-49200-52393-52392-49325-49195-49199-49324-49187-49191-49162-49172-49161-49171-157-49309-156-49308-61-60-53-47-159-52394-49311-158-49310-107-103-57-51-255,0-11-10-16-22-23-49-13-43-45-51-21,29-23-30-25-24,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4868, "name": "TLS_AES_128_CCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49325, "name": "TLS_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49324, "name": "TLS_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49309, "name": "TLS_DHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49308, "name": "TLS_DHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49311, "name": "TLS_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49310, "name": "TLS_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 49, "name": "post_handshake_auth", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 21, "name": "padding", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 1, "first_seen": 1787455754, "last_seen": 1787455754, "transport": "t", "ja3_hash": "329b565abdf75223103131e11ead4844", "user_agents": { "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36": 1 } } }, { "hash": "t13d4311ht_c7886603b240_2c1cef87663c", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d4311ht", "b": "c7886603b240", "c": "2c1cef87663c", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 43, "extension_count": 11, "alpn": "ht" } }, "ja3_string": "771,4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255,0-11-10-16-22-23-13-43-45-51-21,29-23-30-25-24-256-257-258-259-260,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49327, "name": "TLS_DHE_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49325, "name": "TLS_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49326, "name": "TLS_DHE_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49324, "name": "TLS_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49315, "name": "TLS_ECDHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49311, "name": "TLS_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49314, "name": "TLS_ECDHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49310, "name": "TLS_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49313, "name": "TLS_ECDHE_ECDSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49309, "name": "TLS_DHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49312, "name": "TLS_ECDHE_ECDSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49308, "name": "TLS_DHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 21, "name": "padding", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true }, { "value": 258, "name": "ffdhe4096", "known": true }, { "value": 259, "name": "259 (0x0103)", "known": false }, { "value": 260, "name": "260 (0x0104)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 1, "first_seen": 1787450525, "last_seen": 1787450525, "transport": "t", "ja3_hash": "9f391dd564088ea4825b1c039dca6142", "user_agents": { "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36": 1 } } }, { "hash": "t13d4312ht_c7886603b240_d89d4c7b8e02", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d4312ht", "b": "c7886603b240", "c": "d89d4c7b8e02", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 43, "extension_count": 12, "alpn": "ht" } }, "ja3_string": "771,4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255,0-11-10-16-22-23-49-13-43-45-51-21,29-23-30-25-24-256-257-258-259-260,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49327, "name": "TLS_DHE_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49325, "name": "TLS_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49326, "name": "TLS_DHE_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49324, "name": "TLS_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49315, "name": "TLS_ECDHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49311, "name": "TLS_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49314, "name": "TLS_ECDHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49310, "name": "TLS_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49313, "name": "TLS_ECDHE_ECDSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49309, "name": "TLS_DHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49312, "name": "TLS_ECDHE_ECDSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49308, "name": "TLS_DHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 49, "name": "post_handshake_auth", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 21, "name": "padding", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true }, { "value": 258, "name": "ffdhe4096", "known": true }, { "value": 259, "name": "259 (0x0103)", "known": false }, { "value": 260, "name": "260 (0x0104)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 4, "first_seen": 1787447979, "last_seen": 1787460030, "transport": "t", "ja3_hash": "07ff1e545ef8ab3fcf8a4dc9272221c2", "user_agents": { "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.129 Safari/537.36": 2, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36": 21 } } }, { "hash": "t13d450900_d524c25c267f_295fbc80e014", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d450900", "b": "d524c25c267f", "c": "295fbc80e014", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 45, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4866-4865-49196-49195-49200-49199-159-163-158-162-49188-49192-49187-49191-107-106-103-64-49198-49202-49197-49201-49190-49194-49189-49193-49162-49172-49161-49171-57-56-51-50-49157-49167-49156-49166-157-156-61-60-53-47-255,0-10-11-13-50-23-43-45-51,23-24-25-256-257-258-259-260,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 163, "name": "163 (0x00a3)", "known": false }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 162, "name": "162 (0x00a2)", "known": false }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 106, "name": "106 (0x006a)", "known": false }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 64, "name": "64 (0x0040)", "known": false }, { "value": 49198, "name": "49198 (0xc02e)", "known": false }, { "value": 49202, "name": "49202 (0xc032)", "known": false }, { "value": 49197, "name": "49197 (0xc02d)", "known": false }, { "value": 49201, "name": "49201 (0xc031)", "known": false }, { "value": 49190, "name": "49190 (0xc026)", "known": false }, { "value": 49194, "name": "49194 (0xc02a)", "known": false }, { "value": 49189, "name": "49189 (0xc025)", "known": false }, { "value": 49193, "name": "49193 (0xc029)", "known": false }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 56, "name": "56 (0x0038)", "known": false }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 50, "name": "50 (0x0032)", "known": false }, { "value": 49157, "name": "49157 (0xc005)", "known": false }, { "value": 49167, "name": "49167 (0xc00f)", "known": false }, { "value": 49156, "name": "49156 (0xc004)", "known": false }, { "value": 49166, "name": "49166 (0xc00e)", "known": false }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 50, "name": "signature_algorithms_cert", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true }, { "value": 258, "name": "ffdhe4096", "known": true }, { "value": 259, "name": "259 (0x0103)", "known": false }, { "value": 260, "name": "260 (0x0104)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 15, "first_seen": 1787442891, "last_seen": 1787459919, "transport": "t", "ja3_hash": "479b976148ec2a1a195ae2e15805fefa", "user_agents": { "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; Amazonbot/0.1; +https://developer.amazon.com/support/amazonbot) Chrome/119.0.6045.214 Safari/537.36": 10, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_1) AppleWebKit/600.2.5 (KHTML, like Gecko) Version/8.0.2 Safari/600.2.5 (Gort)": 2 } } }, { "hash": "t13d591000_a33745022dd6_1075c442c310", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Firefox \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d591000", "b": "a33745022dd6", "c": "1075c442c310", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 59, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4866-4867-4865-49199-49195-49200-49196-158-49191-103-49192-107-163-159-52393-52392-52394-49327-49325-49315-49311-49245-49249-49239-49235-162-49326-49324-49314-49310-49244-49248-49238-49234-49188-106-49187-64-49162-49172-57-56-49161-49171-51-50-157-49313-49309-49233-156-49312-49308-49232-61-60-53-47-255,0-11-10-35-22-23-13-43-45-51,29-23-30-25-24-256-257-258-259-260,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 163, "name": "163 (0x00a3)", "known": false }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49327, "name": "TLS_DHE_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49325, "name": "TLS_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49315, "name": "TLS_ECDHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49311, "name": "TLS_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49245, "name": "49245 (0xc05d)", "known": false }, { "value": 49249, "name": "TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_CBC_SHA384", "known": true }, { "value": 49239, "name": "49239 (0xc057)", "known": false }, { "value": 49235, "name": "49235 (0xc053)", "known": false }, { "value": 162, "name": "162 (0x00a2)", "known": false }, { "value": 49326, "name": "TLS_DHE_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49324, "name": "TLS_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49314, "name": "TLS_ECDHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49310, "name": "TLS_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49244, "name": "49244 (0xc05c)", "known": false }, { "value": 49248, "name": "TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 49238, "name": "49238 (0xc056)", "known": false }, { "value": 49234, "name": "49234 (0xc052)", "known": false }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 106, "name": "106 (0x006a)", "known": false }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 64, "name": "64 (0x0040)", "known": false }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 56, "name": "56 (0x0038)", "known": false }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 50, "name": "50 (0x0032)", "known": false }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49313, "name": "TLS_ECDHE_ECDSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49309, "name": "TLS_DHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49233, "name": "49233 (0xc051)", "known": false }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49312, "name": "TLS_ECDHE_ECDSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49308, "name": "TLS_DHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49232, "name": "49232 (0xc050)", "known": false }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true }, { "value": 258, "name": "ffdhe4096", "known": true }, { "value": 259, "name": "259 (0x0103)", "known": false }, { "value": 260, "name": "260 (0x0104)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 1, "first_seen": 1787458677, "last_seen": 1787458677, "transport": "t", "ja3_hash": "0cce74b0d9b7f8528fb2181588d23793", "user_agents": { "Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/115.0": 1 } } }, { "hash": "t13d9912ht_ee3966d44962_1c142f2ba1d1", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d9912ht", "b": "ee3966d44962", "c": "1c142f2ba1d1", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 99, "extension_count": 12, "alpn": "ht" } }, "ja3_string": "771,4866-4867-4865-49196-49200-163-159-52393-52392-52394-49325-49311-49245-49249-49239-49235-167-49195-49199-162-158-49324-49310-49244-49248-49238-49234-166-49327-49326-49315-49314-49188-49192-107-106-49267-49271-196-195-109-197-49187-49191-103-64-49266-49270-190-189-108-191-49162-49172-57-56-136-135-49177-58-137-49161-49171-51-50-69-68-49176-52-70-49160-49170-22-19-49175-27-157-49309-49233-156-49308-49232-49313-49312-61-192-60-186-53-132-47-65-10-49158-49168-49173-59-2-1-255,0-11-10-35-16-22-23-13-43-45-51-21,29-23-30-25-24-256-257-258-259-260,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 163, "name": "163 (0x00a3)", "known": false }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49325, "name": "TLS_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49311, "name": "TLS_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49245, "name": "49245 (0xc05d)", "known": false }, { "value": 49249, "name": "TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_CBC_SHA384", "known": true }, { "value": 49239, "name": "49239 (0xc057)", "known": false }, { "value": 49235, "name": "49235 (0xc053)", "known": false }, { "value": 167, "name": "167 (0x00a7)", "known": false }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 162, "name": "162 (0x00a2)", "known": false }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49324, "name": "TLS_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49310, "name": "TLS_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49244, "name": "49244 (0xc05c)", "known": false }, { "value": 49248, "name": "TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 49238, "name": "49238 (0xc056)", "known": false }, { "value": 49234, "name": "49234 (0xc052)", "known": false }, { "value": 166, "name": "166 (0x00a6)", "known": false }, { "value": 49327, "name": "TLS_DHE_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49326, "name": "TLS_DHE_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49315, "name": "TLS_ECDHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49314, "name": "TLS_ECDHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 106, "name": "106 (0x006a)", "known": false }, { "value": 49267, "name": "TLS_ECDHE_RSA_WITH_CAMELLIA_256_CBC_SHA384", "known": true }, { "value": 49271, "name": "TLS_RSA_WITH_CAMELLIA_256_GCM_SHA384", "known": true }, { "value": 196, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA256", "known": true }, { "value": 195, "name": "195 (0x00c3)", "known": false }, { "value": 109, "name": "109 (0x006d)", "known": false }, { "value": 197, "name": "197 (0x00c5)", "known": false }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 64, "name": "64 (0x0040)", "known": false }, { "value": 49266, "name": "TLS_ECDHE_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 49270, "name": "TLS_RSA_WITH_CAMELLIA_128_GCM_SHA256", "known": true }, { "value": 190, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 189, "name": "189 (0x00bd)", "known": false }, { "value": 108, "name": "108 (0x006c)", "known": false }, { "value": 191, "name": "191 (0x00bf)", "known": false }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 56, "name": "56 (0x0038)", "known": false }, { "value": 136, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 135, "name": "135 (0x0087)", "known": false }, { "value": 49177, "name": "49177 (0xc019)", "known": false }, { "value": 58, "name": "58 (0x003a)", "known": false }, { "value": 137, "name": "137 (0x0089)", "known": false }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 50, "name": "50 (0x0032)", "known": false }, { "value": 69, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 68, "name": "68 (0x0044)", "known": false }, { "value": 49176, "name": "49176 (0xc018)", "known": false }, { "value": 52, "name": "52 (0x0034)", "known": false }, { "value": 70, "name": "70 (0x0046)", "known": false }, { "value": 49160, "name": "TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 22, "name": "TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 19, "name": "19 (0x0013)", "known": false }, { "value": 49175, "name": "49175 (0xc017)", "known": false }, { "value": 27, "name": "27 (0x001b)", "known": false }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49309, "name": "TLS_DHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49233, "name": "49233 (0xc051)", "known": false }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49308, "name": "TLS_DHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49232, "name": "49232 (0xc050)", "known": false }, { "value": 49313, "name": "TLS_ECDHE_ECDSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49312, "name": "TLS_ECDHE_ECDSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 192, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 186, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 132, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 65, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49158, "name": "49158 (0xc006)", "known": false }, { "value": 49168, "name": "49168 (0xc010)", "known": false }, { "value": 49173, "name": "49173 (0xc015)", "known": false }, { "value": 59, "name": "59 (0x003b)", "known": false }, { "value": 2, "name": "2 (0x0002)", "known": false }, { "value": 1, "name": "1 (0x0001)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 21, "name": "padding", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true }, { "value": 258, "name": "ffdhe4096", "known": true }, { "value": 259, "name": "259 (0x0103)", "known": false }, { "value": 260, "name": "260 (0x0104)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 4, "first_seen": 1787442958, "last_seen": 1787461479, "transport": "t", "ja3_hash": "6fcafe7a659fde3135f818ad9eb434ad", "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.4 Safari/605.1.15 (Applebot/0.1; +http://www.apple.com/go/applebot)": 3 } } }, { "hash": "t13i1510h2_8daaf6152771_f5e1d6a86f22", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1510h2", "b": "8daaf6152771", "c": "f5e1d6a86f22", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-10-65281-65037-13-23-16-5-43-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1787461272, "last_seen": 1787461272, "transport": "t", "ja3_hash": "800a498d6b8fd5067602bc1a143949de", "user_agents": { "Mozilla/5.0 (iPhone; CPU iPhone OS 11_0 like Mac OS X) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.7694.1317 Mobile Safari/537.36": 2 } } }, { "hash": "t13i1515h2_8daaf6152771_0aed32fb2910", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1515h2", "b": "8daaf6152771", "c": "0aed32fb2910", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 15, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17513-13-35-43-16-27-65281-65037-51-18-45-10-5-11-23,29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17513, "name": "application_settings", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1787461213, "last_seen": 1787461213, "transport": "t", "ja3_hash": "f9def508e13fd5a68d6b079776ded805", "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36": 1 } } }, { "hash": "t13i1515h2_8daaf6152771_fccf9dc7fe97", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1515h2", "b": "8daaf6152771", "c": "fccf9dc7fe97", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 15, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-23-10-11-5-43-18-35-65281-17613-16-13-45-65037-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1787460789, "last_seen": 1787460789, "transport": "t", "ja3_hash": "a47269486f3d717dd48449a5a5cc8ed5", "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36": 1 } } }, { "hash": "t13i1909h2_9dc949149365_c6544fb8b0b1", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1909h2", "b": "9dc949149365", "c": "c6544fb8b0b1", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 19, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,52392-52393-49199-49200-49195-49196-49171-49161-49172-49162-156-157-47-53-49170-10-4867-4865-4866,5-10-11-13-65281-16-18-43-51,29-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 8, "first_seen": 1787450021, "last_seen": 1787458184, "transport": "t", "ja3_hash": "7c1e207beb00684bbbe144f1b0abe1d5", "user_agents": { "Mozilla/5.0 (compatible; CyberConvoyScout/1.0; +https://scout.cyberconvoy.co)": 1, "visionheight.com/scan Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome/126.0.0.0 Safari/537.36": 2 } } }, { "hash": "t13i311100_e8f1e7e78f70_ccd0985badbe", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Firefox \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i311100", "b": "e8f1e7e78f70", "c": "ccd0985badbe", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 31, "extension_count": 11, "alpn": null } }, "ja3_string": "771,4866-4867-4865-49196-49200-159-52393-52392-52394-49195-49199-158-49188-49192-107-49187-49191-103-49162-49172-57-49161-49171-51-157-156-61-60-53-47-255,11-10-35-5-22-23-13-43-45-51-21,29-23-30-25-24-256-257-258-259-260,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 21, "name": "padding", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true }, { "value": 258, "name": "ffdhe4096", "known": true }, { "value": 259, "name": "259 (0x0103)", "known": false }, { "value": 260, "name": "260 (0x0104)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 1, "first_seen": 1787457281, "last_seen": 1787457281, "transport": "t", "ja3_hash": "cd350275e54f0c0d6df9f3c93af0211d", "user_agents": { "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:134.0) Gecko/20100101 Firefox/134.0": 1 } } }, { "hash": "t10i040700_cefcabfea53d_28adf769107b", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (legacy TLS, no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t10i040700", "b": "cefcabfea53d", "c": "28adf769107b", "properties": { "transport": "TCP", "tls_version": "TLS 1.0", "sni": "no server name (IP literal)", "cipher_count": 4, "extension_count": 7, "alpn": null } }, "ja3_string": "769,49161-49171-49162-49172,11-65281-23-18-5-10-43,29-23-24-25,0", "ja3_decoded": { "version": { "value": 769, "name": "TLS 1.0" }, "ciphers": [ { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 43, "name": "supported_versions", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1787448779, "last_seen": 1787448779, "transport": "t", "ja3_hash": "af232ab01c5a432d1148b4f805c5df16", "user_agents": [] } }, { "hash": "t11d6911ht_ea0618708e31_6f77ef117592", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Legacy TLS client \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t11d6911ht", "b": "ea0618708e31", "c": "6f77ef117592", "properties": { "transport": "TCP", "tls_version": "TLS 1.1", "sni": "server name sent", "cipher_count": 69, "extension_count": 11, "alpn": "ht" } }, "ja3_string": "770,22-51-103-49310-49314-158-57-107-49311-49315-159-69-190-136-196-154-49160-49161-49187-49324-49326-49195-49162-49188-49325-49327-49196-49266-49267-52393-4866-4865-52244-49159-49170-49171-49191-49199-49172-49192-49200-49248-49249-49270-49271-52392-4869-4868-4867-52243-49169-10-47-60-49308-49312-156-53-61-49309-49313-157-65-186-132-192-7-4-5,0-23-1-65281-10-11-35-16-13-51-45,29-23-24-25,0", "ja3_decoded": { "version": { "value": 770, "name": "TLS 1.1" }, "ciphers": [ { "value": 22, "name": "TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49310, "name": "TLS_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49314, "name": "TLS_ECDHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 49311, "name": "TLS_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49315, "name": "TLS_ECDHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 69, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 190, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 136, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 196, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA256", "known": true }, { "value": 154, "name": "TLS_DHE_RSA_WITH_SEED_CBC_SHA", "known": true }, { "value": 49160, "name": "TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49324, "name": "TLS_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49326, "name": "TLS_DHE_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49325, "name": "TLS_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49327, "name": "TLS_DHE_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49266, "name": "TLS_ECDHE_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 49267, "name": "TLS_ECDHE_RSA_WITH_CAMELLIA_256_CBC_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 52244, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256 (draft)", "known": true }, { "value": 49159, "name": "TLS_ECDHE_ECDSA_WITH_RC4_128_SHA", "known": true }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49248, "name": "TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 49249, "name": "TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_CBC_SHA384", "known": true }, { "value": 49270, "name": "TLS_RSA_WITH_CAMELLIA_128_GCM_SHA256", "known": true }, { "value": 49271, "name": "TLS_RSA_WITH_CAMELLIA_256_GCM_SHA384", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4869, "name": "TLS_AES_128_CCM_8_SHA256", "known": true }, { "value": 4868, "name": "TLS_AES_128_CCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52243, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 (draft)", "known": true }, { "value": 49169, "name": "TLS_ECDHE_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49308, "name": "TLS_DHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49312, "name": "TLS_ECDHE_ECDSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 49309, "name": "TLS_DHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49313, "name": "TLS_ECDHE_ECDSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 65, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 186, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 132, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 192, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA256", "known": true }, { "value": 7, "name": "7 (0x0007)", "known": false }, { "value": 4, "name": "TLS_RSA_WITH_RC4_128_MD5", "known": true }, { "value": 5, "name": "TLS_RSA_WITH_RC4_128_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 1, "name": "max_fragment_length", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 4, "first_seen": 1787442811, "last_seen": 1787455075, "transport": "t", "ja3_hash": "006315b3ad276906ff11527f9594e5ba", "user_agents": [] } }, { "hash": "t11i040700_cefcabfea53d_28adf769107b", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (legacy TLS, no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t11i040700", "b": "cefcabfea53d", "c": "28adf769107b", "properties": { "transport": "TCP", "tls_version": "TLS 1.1", "sni": "no server name (IP literal)", "cipher_count": 4, "extension_count": 7, "alpn": null } }, "ja3_string": "770,49161-49171-49162-49172,11-65281-23-18-5-10-43,29-23-24-25,0", "ja3_decoded": { "version": { "value": 770, "name": "TLS 1.1" }, "ciphers": [ { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 43, "name": "supported_versions", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1787448779, "last_seen": 1787448779, "transport": "t", "ja3_hash": "51da711b7d569fac858b548296cc5ca0", "user_agents": [] } }, { "hash": "t12i040900_847a4004cbf9_a92c7c6a82fe", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i040900", "b": "847a4004cbf9", "c": "a92c7c6a82fe", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 4, "extension_count": 9, "alpn": null } }, "ja3_string": "771,49195-49196-49161-49162,11-65281-23-18-5-10-13-50-43,29-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 50, "name": "signature_algorithms_cert", "known": true }, { "value": 43, "name": "supported_versions", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1787448779, "last_seen": 1787448779, "transport": "t", "ja3_hash": "387fec6871738fb5adb3695ca1503040", "user_agents": [] } }, { "hash": "t12i080900_a5784322a9f4_a92c7c6a82fe", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i080900", "b": "a5784322a9f4", "c": "a92c7c6a82fe", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 8, "extension_count": 9, "alpn": null } }, "ja3_string": "771,49199-49200-49171-49172-156-157-47-53,11-65281-23-18-5-10-13-50-43,29-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 50, "name": "signature_algorithms_cert", "known": true }, { "value": 43, "name": "supported_versions", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1787448779, "last_seen": 1787448779, "transport": "t", "ja3_hash": "08457f913bb93e139bca198696428c81", "user_agents": [] } }, { "hash": "t12i130500_2d7513195f68_e51b7354d87f", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i130500", "b": "2d7513195f68", "c": "e51b7354d87f", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 13, "extension_count": 5, "alpn": null } }, "ja3_string": "771,49199-49195-49169-49159-49171-49161-49172-49162-5-47-53-49170-10,5-10-11-13-65281,23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49169, "name": "TLS_ECDHE_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 49159, "name": "TLS_ECDHE_ECDSA_WITH_RC4_128_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 5, "name": "TLS_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 6, "first_seen": 1787443530, "last_seen": 1787461641, "transport": "t", "ja3_hash": "cba7f34191ef2379c1325641f6c6c4f4", "user_agents": [] } }, { "hash": "t12i150100_8daaf6152771_d57af3c6d519", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i150100", "b": "8daaf6152771", "c": "d57af3c6d519", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 1, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1787448808, "last_seen": 1787448808, "transport": "t", "ja3_hash": "89cab90f953fb5d2c8103af10c53d7c3", "user_agents": [] } }, { "hash": "t12i150500_8daaf6152771_242c9289aa66", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i150500", "b": "8daaf6152771", "c": "242c9289aa66", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-18-23-65037-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1787448825, "last_seen": 1787448825, "transport": "t", "ja3_hash": "c1bef2a9309ae373d69b1c59acd5f0b7", "user_agents": [] } }, { "hash": "t12i150500_8daaf6152771_d78550ab7cef", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i150500", "b": "8daaf6152771", "c": "d78550ab7cef", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-10-5-51-65037,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1787454096, "last_seen": 1787454096, "transport": "t", "ja3_hash": "30a96d5776c28d6fa177b360d015cc4e", "user_agents": [] } }, { "hash": "t12i150600_8daaf6152771_7c7d0d8c64cd", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Headless Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150600", "b": "8daaf6152771", "c": "7c7d0d8c64cd", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-17613-65037-45-10-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1787454096, "last_seen": 1787454096, "transport": "t", "ja3_hash": "38f5ecb77bcf48fab67cf97ead7c2cf7", "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/146.0.7680.165 Safari/537.36": 1 } } }, { "hash": "t12i150600_8daaf6152771_c447bfb882ff", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i150600", "b": "8daaf6152771", "c": "c447bfb882ff", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-13-51-18-23-10,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 10, "name": "supported_groups", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1787460803, "last_seen": 1787460803, "transport": "t", "ja3_hash": "cf98c794c58c7abf4115f6e810ae9320", "user_agents": [] } }, { "hash": "t12i150800_8daaf6152771_cba48755fcf7", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i150800", "b": "8daaf6152771", "c": "cba48755fcf7", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-51-17613-5-45-27-11-65037,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 5, "name": "status_request", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1787449828, "last_seen": 1787449828, "transport": "t", "ja3_hash": "35d010b8d0859f0d0e42baed2770836d", "user_agents": [] } }, { "hash": "t12i300600_27daee6acec1_3c5a66c06c35", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t12i300600", "b": "27daee6acec1", "c": "3c5a66c06c35", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 30, "extension_count": 6, "alpn": null } }, "ja3_string": "771,49195-52393-49196-49161-49162-49187-49188-49199-52392-49200-49171-49172-49191-49192-158-52394-159-51-57-103-107-156-157-60-61-47-53-10-5-255,11-10-35-22-23-13,29-23-30-25-24,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 5, "name": "TLS_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 3, "first_seen": 1787444137, "last_seen": 1787459244, "transport": "t", "ja3_hash": "9812cdc989e02988bd1f0734fb6ed1a5", "user_agents": [] } }, { "hash": "t13d150700_8daaf6152771_976d236e7e69", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Headless Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d150700", "b": "8daaf6152771", "c": "976d236e7e69", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-35-43-65281-11-0-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1787454122, "last_seen": 1787454122, "transport": "t", "ja3_hash": "7284b97e5d0de069713c978fb31dc73a", "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/146.0.7680.165 Safari/537.36": 1 } } }, { "hash": "t13d1512h2_8daaf6152771_8012f6768e1d", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Headless Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1512h2", "b": "8daaf6152771", "c": "8012f6768e1d", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-27-16-10-45-23-43-11-65037-13-0-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1787455267, "last_seen": 1787455267, "transport": "t", "ja3_hash": "096d1d88b47f20fba3f79649433fd7c9", "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/146.0.7680.165 Safari/537.36": 1 } } }, { "hash": "t13d1514h2_8daaf6152771_63fb81e2e0b2", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Headless Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1514h2", "b": "8daaf6152771", "c": "63fb81e2e0b2", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-11-16-13-27-35-65281-43-45-5-18-0-10-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1787454328, "last_seen": 1787454328, "transport": "t", "ja3_hash": "8a9dcb4661f794c174249776d1015867", "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/146.0.7680.165 Safari/537.36": 1 } } }, { "hash": "t13d1516h2_8daaf6152771_db113fc12e09", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Headless Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1516h2", "b": "8daaf6152771", "c": "db113fc12e09", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 16, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-18-65037-45-10-13-16-27-0-11-65281-17613-5-35-43-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 5, "name": "status_request", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1787455058, "last_seen": 1787455058, "transport": "t", "ja3_hash": "33bd69266434a2e759155d284d3dd9be", "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/146.0.7680.165 Safari/537.36": 1 } } }, { "hash": "t13d311000_8ae6a2f5ac15_7ef8eb972a3c", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "SemrushBot \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d311000", "b": "8ae6a2f5ac15", "c": "7ef8eb972a3c", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 31, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4866-4867-4865-47-49196-49200-49327-49325-49195-49199-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-157-49313-49309-156-49312-49308-61-60-53-65-255,0-11-10-35-22-23-13-43-45-51,29-23-30-25-24,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49327, "name": "TLS_DHE_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49325, "name": "TLS_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49326, "name": "TLS_DHE_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49324, "name": "TLS_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49313, "name": "TLS_ECDHE_ECDSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49309, "name": "TLS_DHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49312, "name": "TLS_ECDHE_ECDSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49308, "name": "TLS_DHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 65, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 11, "first_seen": 1787450670, "last_seen": 1787461682, "transport": "t", "ja3_hash": "e4228d1fa6f13a432e4bc5ff54841b91", "user_agents": { "Mozilla/5.0 (compatible; SemrushBot/7~bl; +http://www.semrush.com/bot.html)": 11 } } }, { "hash": "t13d351300_bfa337485184_07030ae8cff1", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "MJ12bot \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d351300", "b": "bfa337485184", "c": "07030ae8cff1", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 35, "extension_count": 13, "alpn": null } }, "ja3_string": "771,4866-4867-4865-4868-49196-49200-52393-52392-49325-49195-49199-49324-49187-49191-49162-49172-49161-49171-157-49309-156-49308-61-60-53-47-159-52394-49311-158-49310-107-103-57-51,65281-0-11-10-35-5-22-23-13-43-45-51-27,29-23-30-25-24-256-257-258-259-260,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4868, "name": "TLS_AES_128_CCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49325, "name": "TLS_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49324, "name": "TLS_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49309, "name": "TLS_DHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49308, "name": "TLS_DHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49311, "name": "TLS_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49310, "name": "TLS_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 27, "name": "compress_certificate", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true }, { "value": 258, "name": "ffdhe4096", "known": true }, { "value": 259, "name": "259 (0x0103)", "known": false }, { "value": 260, "name": "260 (0x0104)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 3, "first_seen": 1787455875, "last_seen": 1787459239, "transport": "t", "ja3_hash": "946df659d56e0ff7ee9c15561df14a6f", "user_agents": { "Mozilla/5.0 (compatible; MJ12bot/v2.0.5; http://mj12bot.com/)": 6 } } }, { "hash": "t13i031000_55b375c5d22e_4a12575e92d6", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i031000", "b": "55b375c5d22e", "c": "4a12575e92d6", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 3, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4865-4866-4867,11-65281-23-18-5-10-13-50-43-51,4588-29-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 50, "name": "signature_algorithms_cert", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1787448779, "last_seen": 1787448779, "transport": "t", "ja3_hash": "4b7c9e5cd9596f4aafe940b8fc41ff89", "user_agents": [] } }, { "hash": "t13i131000_f57a46bbacb6_ab7e3b40a677", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i131000", "b": "f57a46bbacb6", "c": "ab7e3b40a677", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 13, "extension_count": 10, "alpn": null } }, "ja3_string": "771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-4865-4866-4867,11-65281-23-18-5-10-13-50-43-51,4588-29-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 50, "name": "signature_algorithms_cert", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 2, "first_seen": 1787452441, "last_seen": 1787452442, "transport": "t", "ja3_hash": "725543c78edf669194c11dc7a039b56e", "user_agents": { "curl/7.61.1": 1 } } }, { "hash": "t13i140900_cbb2034c60b8_e7c285222651", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i140900", "b": "cbb2034c60b8", "c": "e7c285222651", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 14, "extension_count": 9, "alpn": null } }, "ja3_string": "771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-49170-4865-4866-4867,11-65281-23-18-5-10-13-43-51,29-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1787451692, "last_seen": 1787451692, "transport": "t", "ja3_hash": "1487bd354c20f20dd642bebc7f706e95", "user_agents": { "net-research-scan/1.0 (+https://example.org/scan-info; abuse contact)": 1 } } }, { "hash": "t13i150600_8daaf6152771_e29d89024e79", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i150600", "b": "8daaf6152771", "c": "e29d89024e79", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-43-11-17613-27-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1787456778, "last_seen": 1787456778, "transport": "t", "ja3_hash": "cfd0ac07f1fafb7f60f399563e26be9b", "user_agents": [] } }, { "hash": "t13i1508h2_8daaf6152771_2cf4cecc651d", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Headless Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1508h2", "b": "8daaf6152771", "c": "2cf4cecc651d", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-16-11-23-5-10-43-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1787455139, "last_seen": 1787455139, "transport": "t", "ja3_hash": "fa22a17abf160f07c441f74525fa405f", "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/146.0.7680.165 Safari/537.36": 1 } } }, { "hash": "t13i190800_9dc949149365_97f8aa674fd9", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i190800", "b": "9dc949149365", "c": "97f8aa674fd9", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 19, "extension_count": 8, "alpn": null } }, "ja3_string": "771,52392-52393-49199-49200-49195-49196-49171-49161-49172-49162-156-157-47-53-49170-10-4867-4865-4866,5-10-11-13-65281-18-43-51,29-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 3, "first_seen": 1787455132, "last_seen": 1787461169, "transport": "t", "ja3_hash": "19e29534fd49dd27d09234e639c4057e", "user_agents": { "Mozilla/5.0 (Linux; Android 10; Pixel 3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/76.0.3809.111 Mobile Safari/537.36": 1, "Mozilla/5.0 (Linux; Android 9; Redmi Note 6 Pro) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/75.0.3770.143 Mobile Safari/537.36": 1 } } }, { "hash": "t13i251000_b78ed14e2fd0_ab7e3b40a677", "kind": "ja4", "tier": "observed", "classification": "scanner", "description": "Probe (no SNI, no ALPN) \u2014 inferred from the JA4 handshake shape.", "ja4": { "a": "t13i251000", "b": "b78ed14e2fd0", "c": "ab7e3b40a677", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 25, "extension_count": 10, "alpn": null } }, "ja3_string": "771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-156-157-47-53-49170-10-49187-49191-60-49159-49169-5-4865-4866-4867,11-65281-23-18-5-10-13-50-43-51,4588-29-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49159, "name": "TLS_ECDHE_ECDSA_WITH_RC4_128_SHA", "known": true }, { "value": 49169, "name": "TLS_ECDHE_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 5, "name": "TLS_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 50, "name": "signature_algorithms_cert", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1787461654, "last_seen": 1787461654, "transport": "t", "ja3_hash": "416eca07dcaad72dec6f76d1277b3eff", "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:141.0) Gecko/20100101 Firefox/141.0": 1 } } }, { "hash": "q13d0311h3_55b375c5d22e_00d49a47e7d1", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Seen in live traffic; not in the curated database.", "ja4": { "a": "q13d0311h3", "b": "55b375c5d22e", "c": "00d49a47e7d1", "properties": { "transport": "QUIC", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 3, "extension_count": 11, "alpn": "h3" } }, "ja3_string": "771,4865-4866-4867,0-57-17513-45-65037-43-13-51-16-27-10,29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 57, "name": "quic_transport_parameters", "known": true }, { "value": 17513, "name": "application_settings", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 10, "name": "supported_groups", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1787455493, "last_seen": 1787455493, "transport": "q", "ja3_hash": "93d71b7e14aba0fb88c4eb9324e2fe9f", "user_agents": [] } }, { "hash": "q13d0311h3_55b375c5d22e_35002cbdedc5", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Seen in live traffic; not in the curated database.", "ja4": { "a": "q13d0311h3", "b": "55b375c5d22e", "c": "35002cbdedc5", "properties": { "transport": "QUIC", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 3, "extension_count": 11, "alpn": "h3" } }, "ja3_string": "771,4866-4865-4867,45-23-16-57-5-43-51-10-13-0-11,29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 57, "name": "quic_transport_parameters", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1787443773, "last_seen": 1787443773, "transport": "q", "ja3_hash": "113515a21095f72cf305bf251707ba0e", "user_agents": [] } }, { "hash": "q13d0311h3_55b375c5d22e_4a886e84af51", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Seen in live traffic; not in the curated database.", "ja4": { "a": "q13d0311h3", "b": "55b375c5d22e", "c": "4a886e84af51", "properties": { "transport": "QUIC", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 3, "extension_count": 11, "alpn": "h3" } }, "ja3_string": "771,4866-4865-4867,13-45-57-0-51-23-5-11-10-43-16,29-23-24-4588,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 57, "name": "quic_transport_parameters", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 4588, "name": "SecP256r1MLKEM768", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1787446502, "last_seen": 1787446502, "transport": "q", "ja3_hash": "37b8826321fde5e8bf226fbfefd01dbc", "user_agents": [] } }, { "hash": "q13d0312h3_55b375c5d22e_2f94236428df", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Seen in live traffic; not in the curated database.", "ja4": { "a": "q13d0312h3", "b": "55b375c5d22e", "c": "2f94236428df", "properties": { "transport": "QUIC", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 3, "extension_count": 12, "alpn": "h3" } }, "ja3_string": "771,4866-4865-4867,57-51-35-10-16-23-43-45-13-0-11-5,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true } ], "extensions": [ { "value": 57, "name": "quic_transport_parameters", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 5, "name": "status_request", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1787460555, "last_seen": 1787460555, "transport": "q", "ja3_hash": "ca82e67e2b10c61fbaebef3aa61acf92", "user_agents": [] } }, { "hash": "q13d0312h3_55b375c5d22e_4bf6f83e6eb6", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Seen in live traffic; not in the curated database.", "ja4": { "a": "q13d0312h3", "b": "55b375c5d22e", "c": "4bf6f83e6eb6", "properties": { "transport": "QUIC", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 3, "extension_count": 12, "alpn": "h3" } }, "ja3_string": "771,4866-4865-4867,10-51-57-13-23-5-0-11-16-43-45-41,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 57, "name": "quic_transport_parameters", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 41, "name": "pre_shared_key", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1787442814, "last_seen": 1787442814, "transport": "q", "ja3_hash": "ec3b840737722876d116686e12dd0369", "user_agents": [] } }, { "hash": "q13d0312h3_55b375c5d22e_f60bf7ff48f5", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Seen in live traffic; not in the curated database.", "ja4": { "a": "q13d0312h3", "b": "55b375c5d22e", "c": "f60bf7ff48f5", "properties": { "transport": "QUIC", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 3, "extension_count": 12, "alpn": "h3" } }, "ja3_string": "771,4865-4866-4867,27-13-57-0-17613-43-65037-51-10-16-45-41,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 57, "name": "quic_transport_parameters", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 41, "name": "pre_shared_key", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1787457066, "last_seen": 1787457066, "transport": "q", "ja3_hash": "9a96b323e005b3bdfb730d499cdd3887", "user_agents": [] } }, { "hash": "t12d130600_2d7513195f68_334f0aaed909", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Seen in live traffic; not in the curated database.", "ja4": { "a": "t12d130600", "b": "2d7513195f68", "c": "334f0aaed909", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 13, "extension_count": 6, "alpn": null } }, "ja3_string": "771,49199-49195-49169-49159-49171-49161-49172-49162-5-47-53-49170-10,0-5-10-11-13-65281,23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49169, "name": "TLS_ECDHE_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 49159, "name": "TLS_ECDHE_ECDSA_WITH_RC4_128_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 5, "name": "TLS_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1787459373, "last_seen": 1787459373, "transport": "t", "ja3_hash": "20c9baf81bfe96ff89722899e75d0190", "user_agents": [] } }, { "hash": "t12d150700_8daaf6152771_07332848f609", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Seen in live traffic; not in the curated database.", "ja4": { "a": "t12d150700", "b": "8daaf6152771", "c": "07332848f609", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-65281-23-51-0-5-10,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1787449157, "last_seen": 1787449157, "transport": "t", "ja3_hash": "7202359c8ee2bcb5b9e889bb975fa3b0", "user_agents": [] } }, { "hash": "t12d1512h2_8daaf6152771_b01b34f94a71", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Seen in live traffic; not in the curated database.", "ja4": { "a": "t12d1512h2", "b": "8daaf6152771", "c": "b01b34f94a71", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-16-23-10-35-13-65281-11-17613-18-27-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1787454025, "last_seen": 1787454025, "transport": "t", "ja3_hash": "75867ef5fe611eec13392e40058576b3", "user_agents": [] } }, { "hash": "t12d200700_22c523c4c553_b871c60bacbc", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Seen in live traffic; not in the curated database.", "ja4": { "a": "t12d200700", "b": "22c523c4c553", "c": "b871c60bacbc", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 20, "extension_count": 7, "alpn": null } }, "ja3_string": "771,49196-49195-49200-49199-159-158-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47,0-10-11-13-35-23-65281,29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1787451585, "last_seen": 1787451585, "transport": "t", "ja3_hash": "095a9cdf6fceacc9c38736015b7d1ec4", "user_agents": [] } }, { "hash": "t12d270800_a2460661a67a_5d316f34096e", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Seen in live traffic; not in the curated database.", "ja4": { "a": "t12d270800", "b": "a2460661a67a", "c": "5d316f34096e", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 27, "extension_count": 8, "alpn": null } }, "ja3_string": "771,49196-49200-159-52393-52392-52394-49195-49199-158-49188-49192-107-49187-49191-103-49162-49172-57-49161-49171-51-157-156-61-60-53-47,65281-0-11-10-35-22-23-13,29-23-30-24-25,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 42, "first_seen": 1787442814, "last_seen": 1787461482, "transport": "t", "ja3_hash": "1c9a15ffefdbe3d51d703fde3c4086eb", "user_agents": [] } }, { "hash": "t12d3411ht_a634f799a498_6f77ef117592", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Seen in live traffic; not in the curated database.", "ja4": { "a": "t12d3411ht", "b": "a634f799a498", "c": "6f77ef117592", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 34, "extension_count": 11, "alpn": "ht" } }, "ja3_string": "771,49171-49191-49199-49172-49192-49200-49248-49249-49270-49271-52392-4869-4868-4867-52243-49169-10-47-60-49308-49312-156-53-61-49309-49313-157-65-186-132-192-7-4-5,0-23-1-65281-10-11-35-16-13-51-45,29-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49248, "name": "TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 49249, "name": "TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_CBC_SHA384", "known": true }, { "value": 49270, "name": "TLS_RSA_WITH_CAMELLIA_128_GCM_SHA256", "known": true }, { "value": 49271, "name": "TLS_RSA_WITH_CAMELLIA_256_GCM_SHA384", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4869, "name": "TLS_AES_128_CCM_8_SHA256", "known": true }, { "value": 4868, "name": "TLS_AES_128_CCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52243, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 (draft)", "known": true }, { "value": 49169, "name": "TLS_ECDHE_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49308, "name": "TLS_DHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49312, "name": "TLS_ECDHE_ECDSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 49309, "name": "TLS_DHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49313, "name": "TLS_ECDHE_ECDSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 65, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 186, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 132, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 192, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA256", "known": true }, { "value": 7, "name": "7 (0x0007)", "known": false }, { "value": 4, "name": "TLS_RSA_WITH_RC4_128_MD5", "known": true }, { "value": 5, "name": "TLS_RSA_WITH_RC4_128_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 1, "name": "max_fragment_length", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 4, "first_seen": 1787442811, "last_seen": 1787455073, "transport": "t", "ja3_hash": "a96dc3876784813c57d302241e620acd", "user_agents": [] } }, { "hash": "t12d3511ht_66c735deec94_6f77ef117592", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Seen in live traffic; not in the curated database.", "ja4": { "a": "t12d3511ht", "b": "66c735deec94", "c": "6f77ef117592", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 35, "extension_count": 11, "alpn": "ht" } }, "ja3_string": "771,49170-49159-52244-4865-4866-52393-49267-49266-49196-49327-49325-49188-49162-49195-49326-49324-49187-49161-49160-154-196-136-190-69-159-49315-49311-107-57-158-49314-49310-103-51-22,0-23-1-65281-10-11-35-16-13-51-45,29-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49159, "name": "TLS_ECDHE_ECDSA_WITH_RC4_128_SHA", "known": true }, { "value": 52244, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256 (draft)", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49267, "name": "TLS_ECDHE_RSA_WITH_CAMELLIA_256_CBC_SHA384", "known": true }, { "value": 49266, "name": "TLS_ECDHE_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49327, "name": "TLS_DHE_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49325, "name": "TLS_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49326, "name": "TLS_DHE_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49324, "name": "TLS_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49160, "name": "TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 154, "name": "TLS_DHE_RSA_WITH_SEED_CBC_SHA", "known": true }, { "value": 196, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA256", "known": true }, { "value": 136, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 190, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 69, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49315, "name": "TLS_ECDHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49311, "name": "TLS_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49314, "name": "TLS_ECDHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49310, "name": "TLS_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 22, "name": "TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 1, "name": "max_fragment_length", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 4, "first_seen": 1787442811, "last_seen": 1787455073, "transport": "t", "ja3_hash": "03a3ad27040f733ee5c9915e0903d028", "user_agents": [] } }, { "hash": "t12d610700_8a10cb45a794_b84f7053a7d6", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Seen in live traffic; not in the curated database.", "ja4": { "a": "t12d610700", "b": "8a10cb45a794", "c": "b84f7053a7d6", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 61, "extension_count": 7, "alpn": null } }, "ja3_string": "771,49200-49196-49202-49198-49199-49195-49201-49197-163-159-162-158-49192-49188-49172-49162-49194-49190-49167-49157-107-106-57-56-49191-49187-49171-49161-49193-49189-49166-49156-103-64-51-50-49170-49160-49165-49155-136-135-69-68-22-19-157-156-61-53-60-47-132-65-10-49169-49159-49164-49154-5-255,0-11-10-35-13-15-21,14-13-25-11-12-24-9-10-22-23-8-6-7-20-21-4-5-18-19-1-2-3-15-16-17,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49202, "name": "49202 (0xc032)", "known": false }, { "value": 49198, "name": "49198 (0xc02e)", "known": false }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49201, "name": "49201 (0xc031)", "known": false }, { "value": 49197, "name": "49197 (0xc02d)", "known": false }, { "value": 163, "name": "163 (0x00a3)", "known": false }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 162, "name": "162 (0x00a2)", "known": false }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49194, "name": "49194 (0xc02a)", "known": false }, { "value": 49190, "name": "49190 (0xc026)", "known": false }, { "value": 49167, "name": "49167 (0xc00f)", "known": false }, { "value": 49157, "name": "49157 (0xc005)", "known": false }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 106, "name": "106 (0x006a)", "known": false }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 56, "name": "56 (0x0038)", "known": false }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49193, "name": "49193 (0xc029)", "known": false }, { "value": 49189, "name": "49189 (0xc025)", "known": false }, { "value": 49166, "name": "49166 (0xc00e)", "known": false }, { "value": 49156, "name": "49156 (0xc004)", "known": false }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 64, "name": "64 (0x0040)", "known": false }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 50, "name": "50 (0x0032)", "known": false }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49160, "name": "TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49165, "name": "49165 (0xc00d)", "known": false }, { "value": 49155, "name": "49155 (0xc003)", "known": false }, { "value": 136, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 135, "name": "135 (0x0087)", "known": false }, { "value": 69, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 68, "name": "68 (0x0044)", "known": false }, { "value": 22, "name": "TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 19, "name": "19 (0x0013)", "known": false }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 132, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 65, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49169, "name": "TLS_ECDHE_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 49159, "name": "TLS_ECDHE_ECDSA_WITH_RC4_128_SHA", "known": true }, { "value": 49164, "name": "49164 (0xc00c)", "known": false }, { "value": 49154, "name": "49154 (0xc002)", "known": false }, { "value": 5, "name": "TLS_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 15, "name": "heartbeat", "known": true }, { "value": 21, "name": "padding", "known": true } ], "curves": [ { "value": 14, "name": "14 (0x000e)", "known": false }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 11, "name": "11 (0x000b)", "known": false }, { "value": 12, "name": "12 (0x000c)", "known": false }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 10, "name": "10 (0x000a)", "known": false }, { "value": 22, "name": "22 (0x0016)", "known": false }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 8, "name": "8 (0x0008)", "known": false }, { "value": 6, "name": "6 (0x0006)", "known": false }, { "value": 7, "name": "7 (0x0007)", "known": false }, { "value": 20, "name": "20 (0x0014)", "known": false }, { "value": 21, "name": "21 (0x0015)", "known": false }, { "value": 4, "name": "4 (0x0004)", "known": false }, { "value": 5, "name": "5 (0x0005)", "known": false }, { "value": 18, "name": "18 (0x0012)", "known": false }, { "value": 19, "name": "19 (0x0013)", "known": false }, { "value": 1, "name": "1 (0x0001)", "known": false }, { "value": 2, "name": "2 (0x0002)", "known": false }, { "value": 3, "name": "3 (0x0003)", "known": false }, { "value": 15, "name": "15 (0x000f)", "known": false }, { "value": 16, "name": "16 (0x0010)", "known": false }, { "value": 17, "name": "17 (0x0011)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 5, "first_seen": 1787443287, "last_seen": 1787458061, "transport": "t", "ja3_hash": "683145f4a4104e2eb28ac44273d13469", "user_agents": [] } }, { "hash": "t12d6911hq_ea0618708e31_6f77ef117592", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Seen in live traffic; not in the curated database.", "ja4": { "a": "t12d6911hq", "b": "ea0618708e31", "c": "6f77ef117592", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 69, "extension_count": 11, "alpn": "hq" } }, "ja3_string": "771,49170-49171-49159-49191-52244-49199-4865-49172-4866-49192-52393-49200-49267-49248-49266-49249-49196-49270-49327-49271-49325-52392-49188-4869-49162-4868-49195-4867-49326-52243-49324-49169-49187-10-49161-47-49160-60-154-49308-196-49312-136-156-190-53-69-61-159-49309-49315-49313-49311-157-107-65-57-186-158-132-49314-192-49310-7-103-4-51-5-22,0-23-1-65281-10-11-35-16-13-51-45,29-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49159, "name": "TLS_ECDHE_ECDSA_WITH_RC4_128_SHA", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 52244, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256 (draft)", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49267, "name": "TLS_ECDHE_RSA_WITH_CAMELLIA_256_CBC_SHA384", "known": true }, { "value": 49248, "name": "TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 49266, "name": "TLS_ECDHE_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 49249, "name": "TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_CBC_SHA384", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49270, "name": "TLS_RSA_WITH_CAMELLIA_128_GCM_SHA256", "known": true }, { "value": 49327, "name": "TLS_DHE_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49271, "name": "TLS_RSA_WITH_CAMELLIA_256_GCM_SHA384", "known": true }, { "value": 49325, "name": "TLS_RSA_WITH_AES_256_CCM", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 4869, "name": "TLS_AES_128_CCM_8_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 4868, "name": "TLS_AES_128_CCM_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49326, "name": "TLS_DHE_RSA_WITH_AES_128_CCM", "known": true }, { "value": 52243, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 (draft)", "known": true }, { "value": 49324, "name": "TLS_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49169, "name": "TLS_ECDHE_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49160, "name": "TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 154, "name": "TLS_DHE_RSA_WITH_SEED_CBC_SHA", "known": true }, { "value": 49308, "name": "TLS_DHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 196, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA256", "known": true }, { "value": 49312, "name": "TLS_ECDHE_ECDSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 136, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 190, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 69, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49309, "name": "TLS_DHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49315, "name": "TLS_ECDHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49313, "name": "TLS_ECDHE_ECDSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49311, "name": "TLS_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 65, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 186, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 132, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 49314, "name": "TLS_ECDHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 192, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA256", "known": true }, { "value": 49310, "name": "TLS_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 7, "name": "7 (0x0007)", "known": false }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 4, "name": "TLS_RSA_WITH_RC4_128_MD5", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 5, "name": "TLS_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 22, "name": "TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 1, "name": "max_fragment_length", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 4, "first_seen": 1787442811, "last_seen": 1787455074, "transport": "t", "ja3_hash": "1289771a3fce256d5fb4cb5c95b43ee6", "user_agents": [] } }, { "hash": "t12d6912hq_ea0618708e31_39577bfd1595", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Seen in live traffic; not in the curated database.", "ja4": { "a": "t12d6912hq", "b": "ea0618708e31", "c": "39577bfd1595", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 69, "extension_count": 12, "alpn": "hq" } }, "ja3_string": "771,22-51-103-49310-49314-158-57-107-49311-49315-159-69-190-136-196-154-49160-49161-49187-49324-49326-49195-49162-49188-49325-49327-49196-49266-49267-52393-4866-4865-52244-49159-49170-49171-49191-49199-49172-49192-49200-49248-49249-49270-49271-52392-4869-4868-4867-52243-49169-10-47-60-49308-49312-156-53-61-49309-49313-157-65-186-132-192-7-4-5,0-23-1-65281-10-11-35-16-13-51-45-43,29-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 22, "name": "TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49310, "name": "TLS_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49314, "name": "TLS_ECDHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 49311, "name": "TLS_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49315, "name": "TLS_ECDHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 69, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 190, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 136, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 196, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA256", "known": true }, { "value": 154, "name": "TLS_DHE_RSA_WITH_SEED_CBC_SHA", "known": true }, { "value": 49160, "name": "TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49324, "name": "TLS_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49326, "name": "TLS_DHE_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49325, "name": "TLS_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49327, "name": "TLS_DHE_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49266, "name": "TLS_ECDHE_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 49267, "name": "TLS_ECDHE_RSA_WITH_CAMELLIA_256_CBC_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 52244, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256 (draft)", "known": true }, { "value": 49159, "name": "TLS_ECDHE_ECDSA_WITH_RC4_128_SHA", "known": true }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49248, "name": "TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 49249, "name": "TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_CBC_SHA384", "known": true }, { "value": 49270, "name": "TLS_RSA_WITH_CAMELLIA_128_GCM_SHA256", "known": true }, { "value": 49271, "name": "TLS_RSA_WITH_CAMELLIA_256_GCM_SHA384", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4869, "name": "TLS_AES_128_CCM_8_SHA256", "known": true }, { "value": 4868, "name": "TLS_AES_128_CCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52243, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 (draft)", "known": true }, { "value": 49169, "name": "TLS_ECDHE_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49308, "name": "TLS_DHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49312, "name": "TLS_ECDHE_ECDSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 49309, "name": "TLS_DHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49313, "name": "TLS_ECDHE_ECDSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 65, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 186, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 132, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 192, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA256", "known": true }, { "value": 7, "name": "7 (0x0007)", "known": false }, { "value": 4, "name": "TLS_RSA_WITH_RC4_128_MD5", "known": true }, { "value": 5, "name": "TLS_RSA_WITH_RC4_128_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 1, "name": "max_fragment_length", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 8, "first_seen": 1787442811, "last_seen": 1787455076, "transport": "t", "ja3_hash": "db8d4ad49cb378fa370b43a61a9b06b6", "user_agents": [] } }, { "hash": "t12d6912ht_ea0618708e31_39577bfd1595", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Seen in live traffic; not in the curated database.", "ja4": { "a": "t12d6912ht", "b": "ea0618708e31", "c": "39577bfd1595", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 69, "extension_count": 12, "alpn": "ht" } }, "ja3_string": "771,5-4-7-192-132-186-65-157-49313-49309-61-53-156-49312-49308-60-47-10-49169-52243-4867-4868-4869-52392-49271-49270-49249-49248-49200-49192-49172-49199-49191-49171-49170-49159-52244-4865-4866-52393-49267-49266-49196-49327-49325-49188-49162-49195-49326-49324-49187-49161-49160-154-196-136-190-69-159-49315-49311-107-57-158-49314-49310-103-51-22,0-23-1-65281-10-11-35-16-13-51-45-43,29-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 5, "name": "TLS_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 4, "name": "TLS_RSA_WITH_RC4_128_MD5", "known": true }, { "value": 7, "name": "7 (0x0007)", "known": false }, { "value": 192, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA256", "known": true }, { "value": 132, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 186, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 65, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49313, "name": "TLS_ECDHE_ECDSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49309, "name": "TLS_DHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49312, "name": "TLS_ECDHE_ECDSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49308, "name": "TLS_DHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49169, "name": "TLS_ECDHE_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 52243, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 (draft)", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4868, "name": "TLS_AES_128_CCM_SHA256", "known": true }, { "value": 4869, "name": "TLS_AES_128_CCM_8_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49271, "name": "TLS_RSA_WITH_CAMELLIA_256_GCM_SHA384", "known": true }, { "value": 49270, "name": "TLS_RSA_WITH_CAMELLIA_128_GCM_SHA256", "known": true }, { "value": 49249, "name": "TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_CBC_SHA384", "known": true }, { "value": 49248, "name": "TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49159, "name": "TLS_ECDHE_ECDSA_WITH_RC4_128_SHA", "known": true }, { "value": 52244, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256 (draft)", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49267, "name": "TLS_ECDHE_RSA_WITH_CAMELLIA_256_CBC_SHA384", "known": true }, { "value": 49266, "name": "TLS_ECDHE_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49327, "name": "TLS_DHE_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49325, "name": "TLS_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49326, "name": "TLS_DHE_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49324, "name": "TLS_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49160, "name": "TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 154, "name": "TLS_DHE_RSA_WITH_SEED_CBC_SHA", "known": true }, { "value": 196, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA256", "known": true }, { "value": 136, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 190, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 69, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49315, "name": "TLS_ECDHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49311, "name": "TLS_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49314, "name": "TLS_ECDHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49310, "name": "TLS_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 22, "name": "TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 1, "name": "max_fragment_length", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 8, "first_seen": 1787442811, "last_seen": 1787455077, "transport": "t", "ja3_hash": "013c30c8ce44c8b27e9ceb2a14db7283", "user_agents": [] } }, { "hash": "t12i1512h2_8daaf6152771_0d4d4b01e00a", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Seen in live traffic; not in the curated database.", "ja4": { "a": "t12i1512h2", "b": "8daaf6152771", "c": "0d4d4b01e00a", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-11-45-23-27-16-10-17613-65037-13-35-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1787442668, "last_seen": 1787442668, "transport": "t", "ja3_hash": "4984cdb54a11f3c4bf9ad6ba326e1cef", "user_agents": [] } }, { "hash": "t13d090900_f91f431d341e_543460421724", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Seen in live traffic; not in the curated database.", "ja4": { "a": "t13d090900", "b": "f91f431d341e", "c": "543460421724", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 9, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4866-4867-4865-49196-49195-52393-49200-49199-52392,51-13-5-23-0-11-45-10-43,4588-24-23,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 43, "name": "supported_versions", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 23, "name": "secp256r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1787442625, "last_seen": 1787442625, "transport": "t", "ja3_hash": "9acd80879b7a4505e943e9aa95377e3b", "user_agents": [] } }, { "hash": "t13d101000_61a7ad8aa9b6_c46b846b2fb1", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Seen in live traffic; not in the curated database.", "ja4": { "a": "t13d101000", "b": "61a7ad8aa9b6", "c": "c46b846b2fb1", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 10, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4866-4865-4867-49196-49195-52393-49200-49199-52392-255,0-23-11-10-35-5-13-45-43-51,29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1787445204, "last_seen": 1787445204, "transport": "t", "ja3_hash": "bdfe01ae63a15c5182d775b9123d80a4", "user_agents": [] } }, { "hash": "t13d101000_61a7ad8aa9b6_d5d75a0face9", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Seen in live traffic; not in the curated database.", "ja4": { "a": "t13d101000", "b": "61a7ad8aa9b6", "c": "d5d75a0face9", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 10, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4866-4865-4867-49196-49195-52393-49200-49199-52392-255,13-5-51-0-23-35-45-11-43-10,29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 10, "name": "supported_groups", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1787442931, "last_seen": 1787442931, "transport": "t", "ja3_hash": "69b40c703f93a71733ce46d1239d84f7", "user_agents": [] } }, { "hash": "t13d1011ht_61a7ad8aa9b6_861bc38b0be4", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Seen in live traffic; not in the curated database.", "ja4": { "a": "t13d1011ht", "b": "61a7ad8aa9b6", "c": "861bc38b0be4", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 10, "extension_count": 11, "alpn": "ht" } }, "ja3_string": "771,4866-4865-4867-49196-49195-52393-49200-49199-52392-255,13-10-45-5-16-43-23-35-11-0-51,29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1787443538, "last_seen": 1787443538, "transport": "t", "ja3_hash": "3a3e0e5cf1f90566736be560d3afd367", "user_agents": [] } }, { "hash": "t13d121000_0ed44715e6cd_badae892920c", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Seen in live traffic; not in the curated database.", "ja4": { "a": "t13d121000", "b": "0ed44715e6cd", "c": "badae892920c", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 12, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49196-49195-49199-49200-49171-49172-156-47-53,0-23-65281-10-11-35-13-51-45-43,29-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 4, "first_seen": 1787446549, "last_seen": 1787449390, "transport": "t", "ja3_hash": "ab1caf6ada0c339e22931167c1fd0e05", "user_agents": [] } }, { "hash": "t13d131100_f57a46bbacb6_0fe28f4911d5", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Seen in live traffic; not in the curated database.", "ja4": { "a": "t13d131100", "b": "f57a46bbacb6", "c": "0fe28f4911d5", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 13, "extension_count": 11, "alpn": null } }, "ja3_string": "771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-4865-4866-4867,0-11-65281-23-18-5-10-13-50-43-51,29-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 50, "name": "signature_algorithms_cert", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 56, "first_seen": 1787442845, "last_seen": 1787461378, "transport": "t", "ja3_hash": "20b279993ae2e137e62b9647c6d768fb", "user_agents": { "Mozilla/5.0 (iPhone; CPU iPhone OS 13_2_3 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/13.0.3 Mobile/15E148 Safari/604.1": 25, "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:124.0) Gecko/20100101 Firefox/124.0": 2, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.6723.70 Safari/537.36": 2 } } }, { "hash": "t13d1312h2_a44d0ee8b3cc_7c86852a3392", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Seen in live traffic; not in the curated database.", "ja4": { "a": "t13d1312h2", "b": "a44d0ee8b3cc", "c": "7c86852a3392", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 13, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49196-49199-49200-49171-156-157-47-53-10,0-23-65281-10-11-35-16-13-51-45-43-21,29-23-24-25-4588-25497-65074,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 21, "name": "padding", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 25497, "name": "X25519Kyber768Draft00", "known": true }, { "value": 65074, "name": "65074 (0xfe32)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 7, "first_seen": 1787444080, "last_seen": 1787459150, "transport": "t", "ja3_hash": "67560f98d68783bd640246df3052c151", "user_agents": { "http://stlweb.dev/wp-admin/install.php?step=1": 2, "http://pqpdf.com/wp-admin/install.php?step=1": 2 } } }, { "hash": "t13d150700_8daaf6152771_9186fb8efbf9", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Seen in live traffic; not in the curated database.", "ja4": { "a": "t13d150700", "b": "8daaf6152771", "c": "9186fb8efbf9", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-43-0-18-5-65037-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1787460342, "last_seen": 1787460342, "transport": "t", "ja3_hash": "495a27f7ed25d6fb99325d4f6279062f", "user_agents": [] } }, { "hash": "t13d150900_8daaf6152771_ae14dce66658", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Seen in live traffic; not in the curated database.", "ja4": { "a": "t13d150900", "b": "8daaf6152771", "c": "ae14dce66658", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-13-5-27-10-43-0-45-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1787459601, "last_seen": 1787459601, "transport": "t", "ja3_hash": "d50f077d24f7df644d58c51ece14ac07", "user_agents": [] } }, { "hash": "t13d1509h2_8daaf6152771_fa668442a24c", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Seen in live traffic; not in the curated database.", "ja4": { "a": "t13d1509h2", "b": "8daaf6152771", "c": "fa668442a24c", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-0-11-65037-5-27-43-16-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1787454097, "last_seen": 1787454097, "transport": "t", "ja3_hash": "d3105df49cf74e5ca77c26c6ac9b0d79", "user_agents": [] } }, { "hash": "t13d151000_8daaf6152771_5b11bbb3fefb", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Seen in live traffic; not in the curated database.", "ja4": { "a": "t13d151000", "b": "8daaf6152771", "c": "5b11bbb3fefb", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-35-0-45-17613-11-43-65037-65281-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1787459601, "last_seen": 1787459601, "transport": "t", "ja3_hash": "ab11b5ea4ed361da146432da27559b53", "user_agents": [] } }, { "hash": "t13d151200_8daaf6152771_db572883c827", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Seen in live traffic; not in the curated database.", "ja4": { "a": "t13d151200", "b": "8daaf6152771", "c": "db572883c827", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-11-35-18-65037-27-0-5-45-10-43-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1787448825, "last_seen": 1787448825, "transport": "t", "ja3_hash": "7ebef7625e3f8dd957d02c0e2b8c6100", "user_agents": [] } }, { "hash": "t13d1514h2_8daaf6152771_f244a6ecff0c", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Seen in live traffic; not in the curated database.", "ja4": { "a": "t13d1514h2", "b": "8daaf6152771", "c": "f244a6ecff0c", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-65281-16-18-11-45-23-10-13-5-17613-27-0-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1787454096, "last_seen": 1787454096, "transport": "t", "ja3_hash": "1b7f0c0edb61cdacc29970eb0694b03f", "user_agents": [] } }, { "hash": "t13d1515h2_8daaf6152771_a8a156b43da0", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Seen in live traffic; not in the curated database.", "ja4": { "a": "t13d1515h2", "b": "8daaf6152771", "c": "a8a156b43da0", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 15, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-11-16-18-65037-23-13-43-45-27-65281-5-0-35-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1787445783, "last_seen": 1787445783, "transport": "t", "ja3_hash": "84894ee3e1701751ea0fbd88109ef658", "user_agents": [] } }, { "hash": "t13d1516h2_8daaf6152771_02e122b4eadb", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Seen in live traffic; not in the curated database.", "ja4": { "a": "t13d1516h2", "b": "8daaf6152771", "c": "02e122b4eadb", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 16, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-65037-35-45-27-43-11-13-10-23-16-65281-5-51-18-17613,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1787450427, "last_seen": 1787450427, "transport": "t", "ja3_hash": "70280ac06e86780d7b14a1dda481e293", "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36 Edg/151.0.0.0": 58 } } }, { "hash": "t13d1516h2_8daaf6152771_9fd9352597e4", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Seen in live traffic; not in the curated database.", "ja4": { "a": "t13d1516h2", "b": "8daaf6152771", "c": "9fd9352597e4", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 16, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17513-45-18-11-16-23-51-0-65037-35-65281-13-10-5-43-27,29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17513, "name": "application_settings", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 27, "name": "compress_certificate", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1787446217, "last_seen": 1787446217, "transport": "t", "ja3_hash": "d782ef34c1140cd4270b12ab406431b5", "user_agents": [] } }, { "hash": "t13d1712h2_5b57614c22b0_13426837f0ce", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Seen in live traffic; not in the curated database.", "ja4": { "a": "t13d1712h2", "b": "5b57614c22b0", "c": "13426837f0ce", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 17, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-52393-49199-52392-49161-49171-156-47-49196-49200-49162-49172-157-53,0-23-65281-10-11-35-16-13-51-45-43-21,29-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 21, "name": "padding", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 4, "first_seen": 1787443983, "last_seen": 1787461378, "transport": "t", "ja3_hash": "f5bd742fa88333052a1deec09f821012", "user_agents": { "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; ChatGPT-User/1.0; +https://openai.com/bot": 3 } } }, { "hash": "t13d1713h2_5b57614c22b0_571c9eeffdb5", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Seen in live traffic; not in the curated database.", "ja4": { "a": "t13d1713h2", "b": "5b57614c22b0", "c": "571c9eeffdb5", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 17, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-52393-49199-52392-49161-49171-156-47-49196-49200-49162-49172-157-53,0-23-65281-10-11-35-16-13-51-45-43-21-41,29-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 21, "name": "padding", "known": true }, { "value": 41, "name": "pre_shared_key", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1787457748, "last_seen": 1787457748, "transport": "t", "ja3_hash": "aa2d0ad206e0981d695e9266f3fa2d65", "user_agents": { "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; ChatGPT-User/1.0; +https://openai.com/bot": 1 } } }, { "hash": "t13d1715h2_5b57614c22b0_2b6791c0b3dd", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Seen in live traffic; not in the curated database.", "ja4": { "a": "t13d1715h2", "b": "5b57614c22b0", "c": "2b6791c0b3dd", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 17, "extension_count": 15, "alpn": "h2" } }, "ja3_string": "771,4865-4867-4866-49195-49199-52393-52392-49196-49200-49162-49161-49171-49172-156-157-47-53,0-23-65281-10-11-35-16-5-34-51-43-13-45-28-21,29-23-24-25-256-257,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 34, "name": "34 (0x0022)", "known": false }, { "value": 51, "name": "key_share", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 28, "name": "record_size_limit", "known": true }, { "value": 21, "name": "padding", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1787459800, "last_seen": 1787459800, "transport": "t", "ja3_hash": "579ccef312d18482fc42e2b822ca2430", "user_agents": [] } }, { "hash": "t13d1715h2_e08a0f08260f_5563d4852cd1", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Seen in live traffic; not in the curated database.", "ja4": { "a": "t13d1715h2", "b": "e08a0f08260f", "c": "5563d4852cd1", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 17, "extension_count": 15, "alpn": "h2" } }, "ja3_string": "257,4867-4865-4866-52393-52392-49195-49199-49196-49200-49171-49172-57363-57427-156-157-47-53,23-65281-10-11-35-16-5-13-18-51-45-43-27-21-0,29-23-24,0", "ja3_decoded": { "version": { "value": 257, "name": "257 (0x0101)" }, "ciphers": [ { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 57363, "name": "57363 (0xe013)", "known": false }, { "value": 57427, "name": "57427 (0xe053)", "known": false }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 21, "name": "padding", "known": true }, { "value": 0, "name": "server_name", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 2, "first_seen": 1787461193, "last_seen": 1787461193, "transport": "t", "ja3_hash": "ef53b4052670264d7c747d36964b86e4", "user_agents": [] } }, { "hash": "t13d201200_2b729b4bf6f3_d42405ff081a", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Seen in live traffic; not in the curated database.", "ja4": { "a": "t13d201200", "b": "2b729b4bf6f3", "c": "d42405ff081a", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 20, "extension_count": 12, "alpn": null } }, "ja3_string": "771,4866-4865-49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47,0-43-13-35-10-11-51-49-23-65281-45-41,29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 49, "name": "post_handshake_auth", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 41, "name": "pre_shared_key", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1787443434, "last_seen": 1787443434, "transport": "t", "ja3_hash": "6ad69cecca55b3321a3261b1ae4aaab1", "user_agents": [] } }, { "hash": "t13d2912h2_723694b0fccc_62e135c949f9", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Seen in live traffic; not in the curated database.", "ja4": { "a": "t13d2912h2", "b": "723694b0fccc", "c": "62e135c949f9", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 29, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4866-4867-4865-4868-49196-52393-49325-49162-49195-49324-49161-49200-52392-49172-49199-49171-157-49309-53-156-49308-47-159-52394-49311-57-158-49310-51,5-10-11-13-16-22-23-51-43-65281-0-28,23-24-25-29-30-256-257-258-259-260,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4868, "name": "TLS_AES_128_CCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49325, "name": "TLS_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49324, "name": "TLS_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49309, "name": "TLS_DHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49308, "name": "TLS_DHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49311, "name": "TLS_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49310, "name": "TLS_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 28, "name": "record_size_limit", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true }, { "value": 258, "name": "ffdhe4096", "known": true }, { "value": 259, "name": "259 (0x0103)", "known": false }, { "value": 260, "name": "260 (0x0104)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1787459960, "last_seen": 1787459960, "transport": "t", "ja3_hash": "8662467bc96db2d387755570446a7946", "user_agents": { "trafilatura/2.1.0 (+https://github.com/adbar/trafilatura)": 1 } } }, { "hash": "t13d301200_1d37bd780c83_55ac72f97122", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Seen in live traffic; not in the curated database.", "ja4": { "a": "t13d301200", "b": "1d37bd780c83", "c": "55ac72f97122", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 30, "extension_count": 12, "alpn": null } }, "ja3_string": "771,4866-4867-4865-49196-49200-159-52393-52392-52394-49195-49199-158-49188-49192-107-49187-49191-103-49162-49172-57-49161-49171-51-157-156-61-60-53-47,65281-0-11-10-35-22-23-13-43-45-51-27,4588-29-23-30-24-25-256-257,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 27, "name": "compress_certificate", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 25, "first_seen": 1787443202, "last_seen": 1787461206, "transport": "t", "ja3_hash": "284deaeae14ea5ddc96c5d7e59855422", "user_agents": { "IndexNow-PQCrypta/1.0": 15 } } }, { "hash": "t13d301300_1d37bd780c83_d0a5066ca47b", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Seen in live traffic; not in the curated database.", "ja4": { "a": "t13d301300", "b": "1d37bd780c83", "c": "d0a5066ca47b", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 30, "extension_count": 13, "alpn": null } }, "ja3_string": "771,4866-4867-4865-49196-49200-159-52393-52392-52394-49195-49199-158-49188-49192-107-49187-49191-103-49162-49172-57-49161-49171-51-157-156-61-60-53-47,65281-0-11-10-35-5-22-23-13-43-45-51-27,4588-4587-4589-25497-25498-12092-12093-570-572-573-512-513-514-580-581-582-12100-12208-516-515-517-12032-12160-29-30-23-24-25,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 27, "name": "compress_certificate", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 4587, "name": "X25519MLKEM768", "known": true }, { "value": 4589, "name": "4589 (0x11ed)", "known": false }, { "value": 25497, "name": "X25519Kyber768Draft00", "known": true }, { "value": 25498, "name": "25498 (0x639a)", "known": false }, { "value": 12092, "name": "12092 (0x2f3c)", "known": false }, { "value": 12093, "name": "12093 (0x2f3d)", "known": false }, { "value": 570, "name": "570 (0x023a)", "known": false }, { "value": 572, "name": "572 (0x023c)", "known": false }, { "value": 573, "name": "573 (0x023d)", "known": false }, { "value": 512, "name": "SecP384r1MLKEM1024", "known": true }, { "value": 513, "name": "513 (0x0201)", "known": false }, { "value": 514, "name": "514 (0x0202)", "known": false }, { "value": 580, "name": "580 (0x0244)", "known": false }, { "value": 581, "name": "581 (0x0245)", "known": false }, { "value": 582, "name": "582 (0x0246)", "known": false }, { "value": 12100, "name": "12100 (0x2f44)", "known": false }, { "value": 12208, "name": "12208 (0x2fb0)", "known": false }, { "value": 516, "name": "516 (0x0204)", "known": false }, { "value": 515, "name": "515 (0x0203)", "known": false }, { "value": 517, "name": "517 (0x0205)", "known": false }, { "value": 12032, "name": "12032 (0x2f00)", "known": false }, { "value": 12160, "name": "12160 (0x2f80)", "known": false }, { "value": 29, "name": "x25519", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 42, "first_seen": 1787442814, "last_seen": 1787461482, "transport": "t", "ja3_hash": "5bb06b0330d11973e4dc558f5fccd10f", "user_agents": [] } }, { "hash": "t13d3013ht_1d37bd780c83_99c94103f5e0", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Seen in live traffic; not in the curated database.", "ja4": { "a": "t13d3013ht", "b": "1d37bd780c83", "c": "99c94103f5e0", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 30, "extension_count": 13, "alpn": "ht" } }, "ja3_string": "771,4866-4867-4865-49196-49200-159-52393-52392-52394-49195-49199-158-49188-49192-107-49187-49191-103-49162-49172-57-49161-49171-51-157-156-61-60-53-47,65281-0-11-10-35-16-22-23-13-43-45-51-27,4588-29-23-30-24-25-256-257,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 27, "name": "compress_certificate", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 69, "first_seen": 1787442812, "last_seen": 1787461482, "transport": "t", "ja3_hash": "8ecf4858a704c8936042f20a8bedee04", "user_agents": [] } }, { "hash": "t13d3014h2_1d37bd780c83_17ac7a7984ce", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Seen in live traffic; not in the curated database.", "ja4": { "a": "t13d3014h2", "b": "1d37bd780c83", "c": "17ac7a7984ce", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 30, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4866-4867-4865-49196-49200-159-52393-52392-52394-49195-49199-158-49188-49192-107-49187-49191-103-49162-49172-57-49161-49171-51-157-156-61-60-53-47,65281-0-11-10-35-16-22-23-13-43-45-51-27-41,4588-29-23-30-24-25-256-257,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 41, "name": "pre_shared_key", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 21, "first_seen": 1787442817, "last_seen": 1787461485, "transport": "t", "ja3_hash": "11334b3fbd23edf608d61f771bc2f1d6", "user_agents": [] } }, { "hash": "t13d311200_1d947a95fc68_30b414fd2f42", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Seen in live traffic; not in the curated database.", "ja4": { "a": "t13d311200", "b": "1d947a95fc68", "c": "30b414fd2f42", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 31, "extension_count": 12, "alpn": null } }, "ja3_string": "771,4866-4865-4867-49196-49195-52393-49200-52392-49199-159-52394-163-158-162-49188-49192-49187-49191-107-106-103-64-49162-49172-49161-49171-57-56-51-50-255,0-5-10-11-17-23-35-13-43-45-50-51,29-23,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 163, "name": "163 (0x00a3)", "known": false }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 162, "name": "162 (0x00a2)", "known": false }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 106, "name": "106 (0x006a)", "known": false }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 64, "name": "64 (0x0040)", "known": false }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 56, "name": "56 (0x0038)", "known": false }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 50, "name": "50 (0x0032)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 17, "name": "status_request_v2", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 50, "name": "signature_algorithms_cert", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 60, "first_seen": 1787443062, "last_seen": 1787461701, "transport": "t", "ja3_hash": "6a61e40083a0978aac19a7bd5aad9a19", "user_agents": [] } }, { "hash": "t13d3112h2_e8f1e7e78f70_d89d4c7b8e02", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Seen in live traffic; not in the curated database.", "ja4": { "a": "t13d3112h2", "b": "e8f1e7e78f70", "c": "d89d4c7b8e02", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 31, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4866-4867-4865-49196-49200-159-52393-52392-52394-49195-49199-158-49188-49192-107-49187-49191-103-49162-49172-57-49161-49171-51-157-156-61-60-53-47-255,0-11-10-16-22-23-49-13-43-45-51-21,29-23-30-25-24-256-257-258-259-260,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 49, "name": "post_handshake_auth", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 21, "name": "padding", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true }, { "value": 258, "name": "ffdhe4096", "known": true }, { "value": 259, "name": "259 (0x0103)", "known": false }, { "value": 260, "name": "260 (0x0104)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 1013, "first_seen": 1787442656, "last_seen": 1787461697, "transport": "t", "ja3_hash": "0149f47eabf9a20d0893e2a44e5a6323", "user_agents": { "proxy-watchdog": 356, "curl/8.18.0-DEV": 53, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36": 39 } } }, { "hash": "t13d3112ht_1d947a95fc68_68567893068e", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Seen in live traffic; not in the curated database.", "ja4": { "a": "t13d3112ht", "b": "1d947a95fc68", "c": "68567893068e", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 31, "extension_count": 12, "alpn": "ht" } }, "ja3_string": "771,4866-4865-4867-49196-49195-52393-49200-52392-49199-159-52394-163-158-162-49188-49192-49187-49191-107-106-103-64-49162-49172-49161-49171-57-56-51-50-255,0-5-10-11-13-50-16-17-23-43-45-51,29-23-24-25-30-256-257-258-259-260,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 163, "name": "163 (0x00a3)", "known": false }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 162, "name": "162 (0x00a2)", "known": false }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 106, "name": "106 (0x006a)", "known": false }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 64, "name": "64 (0x0040)", "known": false }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 56, "name": "56 (0x0038)", "known": false }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 50, "name": "50 (0x0032)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 50, "name": "signature_algorithms_cert", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 17, "name": "status_request_v2", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true }, { "value": 258, "name": "ffdhe4096", "known": true }, { "value": 259, "name": "259 (0x0103)", "known": false }, { "value": 260, "name": "260 (0x0104)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 5, "first_seen": 1787443883, "last_seen": 1787461321, "transport": "t", "ja3_hash": "dc78674c6c856f9f22389e8180ee8350", "user_agents": { "Mozilla/5.0 (compatible; SeznamBot/4.0; +https://o-seznam.cz/napoveda/vyhledavani/en/seznambot-crawler/)": 3 } } }, { "hash": "t13d3112ht_e8f1e7e78f70_64f78f54e6a2", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Seen in live traffic; not in the curated database.", "ja4": { "a": "t13d3112ht", "b": "e8f1e7e78f70", "c": "64f78f54e6a2", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 31, "extension_count": 12, "alpn": "ht" } }, "ja3_string": "771,4866-4867-4865-49196-49200-159-52393-52392-52394-49195-49199-158-49188-49192-107-49187-49191-103-49162-49172-57-49161-49171-51-157-156-61-60-53-47-255,0-11-10-16-22-23-49-13-43-45-51-21,29-23-30-25-24,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 49, "name": "post_handshake_auth", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 21, "name": "padding", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 103, "first_seen": 1787448907, "last_seen": 1787461222, "transport": "t", "ja3_hash": "bc29aa426fc99c0be1b9be941869f88a", "user_agents": { "Mozilla/5.0 (compatible; YandexBot/3.0; +http://yandex.com/bots)": 103, "Mozilla/5.0 (compatible; YandexBot/3.0; +http://yandex.com/bots) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0": 3 } } }, { "hash": "t13d3612ht_018971650b2c_f7fc4ab940eb", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Seen in live traffic; not in the curated database.", "ja4": { "a": "t13d3612ht", "b": "018971650b2c", "c": "f7fc4ab940eb", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 36, "extension_count": 12, "alpn": "ht" } }, "ja3_string": "771,4866-4867-4865-4868-49196-49200-52393-52392-49325-49195-49199-49324-49187-49191-49162-49172-49161-49171-157-49309-156-49308-61-60-53-47-159-52394-49311-158-49310-107-103-57-51-255,0-11-10-35-16-22-23-13-43-45-51-21,29-23-30-25-24,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4868, "name": "TLS_AES_128_CCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49325, "name": "TLS_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49324, "name": "TLS_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49309, "name": "TLS_DHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49308, "name": "TLS_DHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49311, "name": "TLS_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49310, "name": "TLS_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 21, "name": "padding", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 1, "first_seen": 1787445565, "last_seen": 1787445565, "transport": "t", "ja3_hash": "8ecd69af8e3262389176342e8165854e", "user_agents": [] } }, { "hash": "t13d4604h2_a6ef478a285d_db745f7197ad", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Seen in live traffic; not in the curated database.", "ja4": { "a": "t13d4604h2", "b": "a6ef478a285d", "c": "db745f7197ad", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 46, "extension_count": 4, "alpn": "h2" } }, "ja3_string": "771,4867-4866-4865-52393-52392-52394-49200-49196-49192-49188-49172-49162-159-107-57-196-136-157-61-53-192-132-49199-49195-49191-49187-49171-49161-158-103-51-190-69-156-60-47-186-65-49169-49159-5-49170-49160-22-10-255,16-0-43-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 196, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA256", "known": true }, { "value": 136, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 192, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA256", "known": true }, { "value": 132, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 190, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 69, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 186, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 65, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 49169, "name": "TLS_ECDHE_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 49159, "name": "TLS_ECDHE_ECDSA_WITH_RC4_128_SHA", "known": true }, { "value": 5, "name": "TLS_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49160, "name": "TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 22, "name": "TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1787459603, "last_seen": 1787459603, "transport": "t", "ja3_hash": "4492a4122b8701ce0c9ced9de4bf50f3", "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36": 1 } } }, { "hash": "t13d561200_bc01e4e2260a_3bb33b5210f9", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Seen in live traffic; not in the curated database.", "ja4": { "a": "t13d561200", "b": "bc01e4e2260a", "c": "3bb33b5210f9", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 56, "extension_count": 12, "alpn": null } }, "ja3_string": "771,4866-4865-4867-49196-49195-52393-49200-52392-49199-159-52394-163-158-162-49188-49192-49187-49191-107-106-103-64-49198-49202-49197-49201-49190-49194-49189-49193-49162-49172-49161-49171-57-56-51-50-49157-49167-49156-49166-157-156-61-60-53-47-49160-49170-22-19-49155-49165-10-255,0-5-10-11-17-23-35-13-43-45-50-51,29-23-24-25-30-256-257-258-259-260,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 163, "name": "163 (0x00a3)", "known": false }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 162, "name": "162 (0x00a2)", "known": false }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 106, "name": "106 (0x006a)", "known": false }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 64, "name": "64 (0x0040)", "known": false }, { "value": 49198, "name": "49198 (0xc02e)", "known": false }, { "value": 49202, "name": "49202 (0xc032)", "known": false }, { "value": 49197, "name": "49197 (0xc02d)", "known": false }, { "value": 49201, "name": "49201 (0xc031)", "known": false }, { "value": 49190, "name": "49190 (0xc026)", "known": false }, { "value": 49194, "name": "49194 (0xc02a)", "known": false }, { "value": 49189, "name": "49189 (0xc025)", "known": false }, { "value": 49193, "name": "49193 (0xc029)", "known": false }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 56, "name": "56 (0x0038)", "known": false }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 50, "name": "50 (0x0032)", "known": false }, { "value": 49157, "name": "49157 (0xc005)", "known": false }, { "value": 49167, "name": "49167 (0xc00f)", "known": false }, { "value": 49156, "name": "49156 (0xc004)", "known": false }, { "value": 49166, "name": "49166 (0xc00e)", "known": false }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49160, "name": "TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 22, "name": "TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 19, "name": "19 (0x0013)", "known": false }, { "value": 49155, "name": "49155 (0xc003)", "known": false }, { "value": 49165, "name": "49165 (0xc00d)", "known": false }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 17, "name": "status_request_v2", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 50, "name": "signature_algorithms_cert", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true }, { "value": 258, "name": "ffdhe4096", "known": true }, { "value": 259, "name": "259 (0x0103)", "known": false }, { "value": 260, "name": "260 (0x0104)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 30, "first_seen": 1787443135, "last_seen": 1787461167, "transport": "t", "ja3_hash": "1875aec3e9d2d51ffde08cc376aedcff", "user_agents": { "Site24x7": 18 } } }, { "hash": "t13d6412ht_0f757fa8abd0_39577bfd1595", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Seen in live traffic; not in the curated database.", "ja4": { "a": "t13d6412ht", "b": "0f757fa8abd0", "c": "39577bfd1595", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 64, "extension_count": 12, "alpn": "ht" } }, "ja3_string": "771,22-51-103-49310-49314-158-57-107-49311-49315-159-69-190-136-196-154-49160-49161-49187-49324-49326-49195-49162-49188-49325-49327-49196-49266-49267-52393-52244-49159-49170-49171-49191-49199-49172-49192-49200-49248-49249-49270-49271-52392-52243-49169-10-47-60-49308-49312-156-53-61-49309-49313-157-65-186-132-192-7-4-5,0-23-1-65281-10-11-35-16-13-51-45-43,29-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 22, "name": "TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49310, "name": "TLS_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49314, "name": "TLS_ECDHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 49311, "name": "TLS_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49315, "name": "TLS_ECDHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 69, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 190, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 136, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 196, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA256", "known": true }, { "value": 154, "name": "TLS_DHE_RSA_WITH_SEED_CBC_SHA", "known": true }, { "value": 49160, "name": "TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49324, "name": "TLS_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49326, "name": "TLS_DHE_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49325, "name": "TLS_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49327, "name": "TLS_DHE_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49266, "name": "TLS_ECDHE_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 49267, "name": "TLS_ECDHE_RSA_WITH_CAMELLIA_256_CBC_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52244, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256 (draft)", "known": true }, { "value": 49159, "name": "TLS_ECDHE_ECDSA_WITH_RC4_128_SHA", "known": true }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49248, "name": "TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 49249, "name": "TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_CBC_SHA384", "known": true }, { "value": 49270, "name": "TLS_RSA_WITH_CAMELLIA_128_GCM_SHA256", "known": true }, { "value": 49271, "name": "TLS_RSA_WITH_CAMELLIA_256_GCM_SHA384", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52243, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 (draft)", "known": true }, { "value": 49169, "name": "TLS_ECDHE_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49308, "name": "TLS_DHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49312, "name": "TLS_ECDHE_ECDSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 49309, "name": "TLS_DHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49313, "name": "TLS_ECDHE_ECDSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 65, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 186, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 132, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 192, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA256", "known": true }, { "value": 7, "name": "7 (0x0007)", "known": false }, { "value": 4, "name": "TLS_RSA_WITH_RC4_128_MD5", "known": true }, { "value": 5, "name": "TLS_RSA_WITH_RC4_128_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 1, "name": "max_fragment_length", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 4, "first_seen": 1787442811, "last_seen": 1787455077, "transport": "t", "ja3_hash": "917fde1bf3bcb67f961b77b18d9ee14a", "user_agents": [] } }, { "hash": "t13d681100_13e0e9e1c501_6ecbdee5c734", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Seen in live traffic; not in the curated database.", "ja4": { "a": "t13d681100", "b": "13e0e9e1c501", "c": "6ecbdee5c734", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 68, "extension_count": 11, "alpn": null } }, "ja3_string": "771,4866-4867-4865-49199-49195-49200-49196-158-162-163-159-49191-49187-49171-49161-49192-49188-49172-49162-103-51-64-107-56-57-156-157-49324-49310-50-49308-60-47-49325-49311-106-49309-61-53-52393-52392-52394-49245-49249-49239-49235-49244-49248-49238-49234-49267-49271-196-195-49266-49270-190-189-136-135-69-68-49233-49232-192-186-132-65,65281-0-11-10-35-22-23-13-43-45-51,4588-29-23-30-24-25-256-257,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 162, "name": "162 (0x00a2)", "known": false }, { "value": 163, "name": "163 (0x00a3)", "known": false }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 64, "name": "64 (0x0040)", "known": false }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 56, "name": "56 (0x0038)", "known": false }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49324, "name": "TLS_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49310, "name": "TLS_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 50, "name": "50 (0x0032)", "known": false }, { "value": 49308, "name": "TLS_DHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49325, "name": "TLS_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49311, "name": "TLS_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 106, "name": "106 (0x006a)", "known": false }, { "value": 49309, "name": "TLS_DHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49245, "name": "49245 (0xc05d)", "known": false }, { "value": 49249, "name": "TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_CBC_SHA384", "known": true }, { "value": 49239, "name": "49239 (0xc057)", "known": false }, { "value": 49235, "name": "49235 (0xc053)", "known": false }, { "value": 49244, "name": "49244 (0xc05c)", "known": false }, { "value": 49248, "name": "TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 49238, "name": "49238 (0xc056)", "known": false }, { "value": 49234, "name": "49234 (0xc052)", "known": false }, { "value": 49267, "name": "TLS_ECDHE_RSA_WITH_CAMELLIA_256_CBC_SHA384", "known": true }, { "value": 49271, "name": "TLS_RSA_WITH_CAMELLIA_256_GCM_SHA384", "known": true }, { "value": 196, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA256", "known": true }, { "value": 195, "name": "195 (0x00c3)", "known": false }, { "value": 49266, "name": "TLS_ECDHE_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 49270, "name": "TLS_RSA_WITH_CAMELLIA_128_GCM_SHA256", "known": true }, { "value": 190, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 189, "name": "189 (0x00bd)", "known": false }, { "value": 136, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 135, "name": "135 (0x0087)", "known": false }, { "value": 69, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 68, "name": "68 (0x0044)", "known": false }, { "value": 49233, "name": "49233 (0xc051)", "known": false }, { "value": 49232, "name": "49232 (0xc050)", "known": false }, { "value": 192, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA256", "known": true }, { "value": 186, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 132, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 65, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 1, "first_seen": 1787456538, "last_seen": 1787456538, "transport": "t", "ja3_hash": "8c62649fec22c17049a59e7d05c53484", "user_agents": [] } }, { "hash": "t13d691200_ea0618708e31_b613c2328c02", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Seen in live traffic; not in the curated database.", "ja4": { "a": "t13d691200", "b": "ea0618708e31", "c": "b613c2328c02", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 69, "extension_count": 12, "alpn": null } }, "ja3_string": "771,22-51-103-49310-49314-158-57-107-49311-49315-159-69-190-136-196-154-49160-49161-49187-49324-49326-49195-49162-49188-49325-49327-49196-49266-49267-52393-4866-4865-52244-49159-49170-49171-49191-49199-49172-49192-49200-49248-49249-49270-49271-52392-4869-4868-4867-52243-49169-10-47-60-49308-49312-156-53-61-49309-49313-157-65-186-132-192-7-4-5,0-11-10-35-5-22-23-13-43-45-51-21,29-23-30-25-24,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 22, "name": "TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49310, "name": "TLS_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49314, "name": "TLS_ECDHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 49311, "name": "TLS_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49315, "name": "TLS_ECDHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 69, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 190, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 136, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 196, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA256", "known": true }, { "value": 154, "name": "TLS_DHE_RSA_WITH_SEED_CBC_SHA", "known": true }, { "value": 49160, "name": "TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49324, "name": "TLS_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49326, "name": "TLS_DHE_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49325, "name": "TLS_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49327, "name": "TLS_DHE_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49266, "name": "TLS_ECDHE_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 49267, "name": "TLS_ECDHE_RSA_WITH_CAMELLIA_256_CBC_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 52244, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256 (draft)", "known": true }, { "value": 49159, "name": "TLS_ECDHE_ECDSA_WITH_RC4_128_SHA", "known": true }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49248, "name": "TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 49249, "name": "TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_CBC_SHA384", "known": true }, { "value": 49270, "name": "TLS_RSA_WITH_CAMELLIA_128_GCM_SHA256", "known": true }, { "value": 49271, "name": "TLS_RSA_WITH_CAMELLIA_256_GCM_SHA384", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4869, "name": "TLS_AES_128_CCM_8_SHA256", "known": true }, { "value": 4868, "name": "TLS_AES_128_CCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52243, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 (draft)", "known": true }, { "value": 49169, "name": "TLS_ECDHE_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49308, "name": "TLS_DHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49312, "name": "TLS_ECDHE_ECDSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 49309, "name": "TLS_DHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49313, "name": "TLS_ECDHE_ECDSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 65, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 186, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 132, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 192, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA256", "known": true }, { "value": 7, "name": "7 (0x0007)", "known": false }, { "value": 4, "name": "TLS_RSA_WITH_RC4_128_MD5", "known": true }, { "value": 5, "name": "TLS_RSA_WITH_RC4_128_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 21, "name": "padding", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 1, "first_seen": 1787457281, "last_seen": 1787457281, "transport": "t", "ja3_hash": "4ab40ed46d2f0f15292e2ccc59b55f0d", "user_agents": [] } }, { "hash": "t13d6912hq_ea0618708e31_39577bfd1595", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Seen in live traffic; not in the curated database.", "ja4": { "a": "t13d6912hq", "b": "ea0618708e31", "c": "39577bfd1595", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 69, "extension_count": 12, "alpn": "hq" } }, "ja3_string": "771,49170-49171-49159-49191-52244-49199-4865-49172-4866-49192-52393-49200-49267-49248-49266-49249-49196-49270-49327-49271-49325-52392-49188-4869-49162-4868-49195-4867-49326-52243-49324-49169-49187-10-49161-47-49160-60-154-49308-196-49312-136-156-190-53-69-61-159-49309-49315-49313-49311-157-107-65-57-186-158-132-49314-192-49310-7-103-4-51-5-22,0-23-1-65281-10-11-35-16-13-51-45-43,29-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49159, "name": "TLS_ECDHE_ECDSA_WITH_RC4_128_SHA", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 52244, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256 (draft)", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49267, "name": "TLS_ECDHE_RSA_WITH_CAMELLIA_256_CBC_SHA384", "known": true }, { "value": 49248, "name": "TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 49266, "name": "TLS_ECDHE_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 49249, "name": "TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_CBC_SHA384", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49270, "name": "TLS_RSA_WITH_CAMELLIA_128_GCM_SHA256", "known": true }, { "value": 49327, "name": "TLS_DHE_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49271, "name": "TLS_RSA_WITH_CAMELLIA_256_GCM_SHA384", "known": true }, { "value": 49325, "name": "TLS_RSA_WITH_AES_256_CCM", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 4869, "name": "TLS_AES_128_CCM_8_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 4868, "name": "TLS_AES_128_CCM_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49326, "name": "TLS_DHE_RSA_WITH_AES_128_CCM", "known": true }, { "value": 52243, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 (draft)", "known": true }, { "value": 49324, "name": "TLS_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49169, "name": "TLS_ECDHE_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49160, "name": "TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 154, "name": "TLS_DHE_RSA_WITH_SEED_CBC_SHA", "known": true }, { "value": 49308, "name": "TLS_DHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 196, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA256", "known": true }, { "value": 49312, "name": "TLS_ECDHE_ECDSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 136, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 190, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 69, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49309, "name": "TLS_DHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49315, "name": "TLS_ECDHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49313, "name": "TLS_ECDHE_ECDSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49311, "name": "TLS_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 65, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 186, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 132, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 49314, "name": "TLS_ECDHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 192, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA256", "known": true }, { "value": 49310, "name": "TLS_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 7, "name": "7 (0x0007)", "known": false }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 4, "name": "TLS_RSA_WITH_RC4_128_MD5", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 5, "name": "TLS_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 22, "name": "TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 1, "name": "max_fragment_length", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 4, "first_seen": 1787442811, "last_seen": 1787455078, "transport": "t", "ja3_hash": "7f9ae904ef5a8d37a4028ce5c57bc099", "user_agents": [] } }, { "hash": "t13i1514h2_8daaf6152771_153e41bb36c4", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Seen in live traffic; not in the curated database.", "ja4": { "a": "t13i1514h2", "b": "8daaf6152771", "c": "153e41bb36c4", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-10-11-17613-18-45-5-65281-16-43-27-35-23-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1787444019, "last_seen": 1787444019, "transport": "t", "ja3_hash": "342b59add200e1755cde7763ac302142", "user_agents": [] } }, { "hash": "t13i1811ht_85036bcba153_a3954c448de3", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Seen in live traffic; not in the curated database.", "ja4": { "a": "t13i1811ht", "b": "85036bcba153", "c": "a3954c448de3", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 18, "extension_count": 11, "alpn": "ht" } }, "ja3_string": "771,4866-4867-4865-49196-49200-49195-49199-52393-52392-49188-49192-49187-49191-159-158-107-103-255,11-10-35-16-22-23-13-43-45-51-21,29-23-30-25-24-256-257-258-259-260,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 21, "name": "padding", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true }, { "value": 258, "name": "ffdhe4096", "known": true }, { "value": 259, "name": "259 (0x0103)", "known": false }, { "value": 260, "name": "260 (0x0104)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 1, "first_seen": 1787444933, "last_seen": 1787444933, "transport": "t", "ja3_hash": "b0020a04d796a92096d3928b119a51f6", "user_agents": [] } }, { "hash": "t13i3012h2_1d37bd780c83_cde28b4b7b1f", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Seen in live traffic; not in the curated database.", "ja4": { "a": "t13i3012h2", "b": "1d37bd780c83", "c": "cde28b4b7b1f", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 30, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4866-4867-4865-49196-49200-159-52393-52392-52394-49195-49199-158-49188-49192-107-49187-49191-103-49162-49172-57-49161-49171-51-157-156-61-60-53-47,65281-11-10-16-22-23-49-13-43-45-51-27,4588-29-23-30-24-25-256-257,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 49, "name": "post_handshake_auth", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 27, "name": "compress_certificate", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 68, "first_seen": 1787443316, "last_seen": 1787461302, "transport": "t", "ja3_hash": "7587a1ac9a4f17b4e4e5fe226716f4df", "user_agents": [] } }, { "hash": "t13i3514ht_8f004308c246_d27576f0e476", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Seen in live traffic; not in the curated database.", "ja4": { "a": "t13i3514ht", "b": "8f004308c246", "c": "d27576f0e476", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 35, "extension_count": 14, "alpn": "ht" } }, "ja3_string": "771,4865-4867-4866-49195-49199-52393-52392-49196-49200-49162-49161-49171-49172-156-157-47-53-49191-49187-52394-158-159-103-107-51-57-60-49170-22-10-5-49169-49159-52243-52244,23-65281-10-11-35-16-5-34-51-43-13-45-28-65037,29-23-24-25-256-257,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 22, "name": "TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 5, "name": "TLS_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 49169, "name": "TLS_ECDHE_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 49159, "name": "TLS_ECDHE_ECDSA_WITH_RC4_128_SHA", "known": true }, { "value": 52243, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 (draft)", "known": true }, { "value": 52244, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256 (draft)", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 34, "name": "34 (0x0022)", "known": false }, { "value": 51, "name": "key_share", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 28, "name": "record_size_limit", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 7, "first_seen": 1787461206, "last_seen": 1787461207, "transport": "t", "ja3_hash": "90189170f2171f397898ade1c4de4367", "user_agents": { "Mozilla/5.0 (compatible; Infrawatch/1.0; +https://infrawat.ch/)": 7 } } }, { "hash": "t13i4311ht_c7886603b240_aaee209e3cc1", "kind": "ja4", "tier": "observed", "classification": "unclassified", "description": "Seen in live traffic; not in the curated database.", "ja4": { "a": "t13i4311ht", "b": "c7886603b240", "c": "aaee209e3cc1", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 43, "extension_count": 11, "alpn": "ht" } }, "ja3_string": "771,4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49327-49325-49326-49324-49188-49192-49187-49191-49162-49172-49161-49171-49315-49311-49314-49310-107-103-57-51-157-156-49313-49309-49312-49308-61-60-53-47-255,11-10-16-22-23-49-13-43-45-51-21,29-23-30-25-24-256-257-258-259-260,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49327, "name": "TLS_DHE_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49325, "name": "TLS_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49326, "name": "TLS_DHE_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49324, "name": "TLS_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49315, "name": "TLS_ECDHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49311, "name": "TLS_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49314, "name": "TLS_ECDHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49310, "name": "TLS_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49313, "name": "TLS_ECDHE_ECDSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49309, "name": "TLS_DHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49312, "name": "TLS_ECDHE_ECDSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49308, "name": "TLS_DHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 49, "name": "post_handshake_auth", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 21, "name": "padding", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true }, { "value": 258, "name": "ffdhe4096", "known": true }, { "value": 259, "name": "259 (0x0103)", "known": false }, { "value": 260, "name": "260 (0x0104)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 1, "first_seen": 1787449339, "last_seen": 1787449339, "transport": "t", "ja3_hash": "f80d3d09f61892c5846c854dd84ac403", "user_agents": [] } } ] }