{ "generated_at": "2026-10-09T20:30:04+00:00", "source": "pqcrypta-proxy curated database + live observations", "total": 6869, "of": 6869, "tiers": { "curated": 179, "observed": 6690 }, "query": { "q": "", "class": "all", "tier": "all", "sort": "default" }, "license": "CC BY 4.0", "docs": "https://pqcrypta.com/ja4/", "entries": [ { "hash": "01319090aea981dde6fc8d6ae71ead54", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "vpnkit", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "028563cffc7a3a2e32090aee0294d636", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "java,eclipse,STS", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "0411bbb5ff27ad46e1874a7a8beedacb", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "eclipse", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "093081b45872912be9a1f2a8163fe041", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "java", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "0ef9ca1c10d3f186f5786e1ef3461a46", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "bitgo,ShapeShift", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "0fe51fa93812c2ebb50a655222a57bf2", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "LINE Messaging", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "106ecbd3d14b4dc6e413494263720afe", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "node.js,Postman,WhatsApp", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "107144b88827da5da9ed42d8776ccdc5", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "geod", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "116ffc8889873efad60457cd55eaf543", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "Spark", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "187dfde7edc8ceddccd3deeccc21daeb", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "eclipse,java,studio,STS", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "190dfb280fe3b541acc6a2e5f00690e6", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "Used by many programs,Quip,Spotify,Dropbox,GitHub Desktop,etc", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "193349d34561d1d5d1a270172eb2d97e", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "LogMeIn Client", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "1fbe5382f9d8430fe921df747c46d95f", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "FieldServiceApp,socialstudio", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "2080bf56cb87e64303e27fcd781e7efd", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "java", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "225a24b45f0f1adbc2e245d4624c6e08", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "java", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "2d3854d1cbcdceece83eabd85bdcc056", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "Tableau", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "2db6873021f2a95daa7de0d93a1d1bf2", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "java,studio,eclipse", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "2e094913d88f0ad8dc69447cb7d2ce65", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "LINE Messaging", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "32e4b8812cda0c0d50783b438492a769", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "curl 8.x (observed 2026-07-31)", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "38cbe70b308f42da7c9980c0e1c89656", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "p4v,owncloud", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "3959d0a1344896e9fb5c0564ca0a2956", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "LeagueClientUx", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "39cf5b7a13a764494de562add874f016", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "Steam OSX", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "3afe1fb5976d0999abe833b14b7d6485", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "java", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "3b844830bfbb12eb5d2f8dc281d349a9", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "java", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "3e860202fc555b939e83e7a7ab518c38", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "hola_svc", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "4056657a50a8a4e5cfac40ba48becfa2", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "java,eclipse", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "424008725394c634a4616b8b1f2828a5", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "Charles,java,eclipse", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "488b6b601cb141b062d4da7f524b4b22", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "Used by many programs,Python,PHP,Git,dotnet,Adobe", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "4990c9da08f44a01ecd7ddc3837caf25", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "eclipse", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "49a341a21f4fd4ac63b027ff2b1a331f", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "Skype", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "49a6cf42956937669a01438f26e7c609", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "AIM", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "49de9b1c7e60bd3b8e1d4f7a49ba362e", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "nwjs,Chromium", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "4fcd1770545298cc119865aeba81daba", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "Deezer", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "51a7ad14509fd614c7bb3a50c4982b8c", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "java", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "550628650380ff418de25d3d890e836e", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "java", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "5507277945374659a5b4572e1b6d9b9f", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "apple.geod", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "561145462cfc7de1d6a97e93d3264786", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "Airmail 3", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "56ac3a0bef0824c49e4b569941937088", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "hola_svc", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "5af143afdbf58ec11ab3b3d53dd4e5e3", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "IDSyncDaemon", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "5b270b309ad8c6478586a15dece20a88", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "java", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "5c1c89f930122bccc7a97d52f73bea2c", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "hola_svc", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "5cfbaea088a6084eefed5c5e8c3972ec", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "GNU Wget (observed 2026-07-31)", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "5d7abe53ae15b4272a34f10431e06bf3", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "java", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "5ee1a653fb824db7182714897fd3b5df", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "Citrix Viewer", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "5f9b53f0d39dc9d940a3b5568fe5f0bb", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "java,JavaApplicationStub", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "6003b52942a2e1e1ea72d802d153ec08", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "Amazon Music", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "61d50e7771aee7f2f4b89a7200b4d45e", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "AcroCEF", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "62448833d8230241227c03b7d441e31b", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "parsecd,apple.geod,apple.photomoments,photoanalysisd,FreedomProxy", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "641df9d6dbe7fdb74f70c8ad93def8cc", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "node.js", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "6acb250ada693067812c3335705dae79", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "mono-sgen,Syncplicity,Axure RP 8,Amazon Drive", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "77310efe11f1943306ee317cf02150b7", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "hola_svc", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "7c7a68b96d2aab15d678497a12119f4f", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "java", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "83e04bc58d402f9633983cbf22724b02", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "Charles,Google Play Music Desktop Player,Postman,Slack,and other desktop programs", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "84071ea96fc8a60c55fc8a405e214c0f", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "Used by many desktop apps,Quip,Spotify,GitHub Desktop", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "844166382cc98d98595e6778c470f5d5", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "Salesforce Files", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "84607748f3887541dd60fe974a042c71", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "wineserver", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "88afa0dea1608e28f50acbad32d7f195", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "java", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "88f1fd7a4ad8bf2abd56176f5455424b", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "OpenSSL s_client (observed 2026-07-31)", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "8bd59c4b7f3193db80fd64318429bcec", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "hola_svc", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "8c5a50f1e833ed581e9cfc690814719a", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "eclipse,JavaApplicationStub,idea", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "8ce6933b8c12ce931ca238e9420cc5dd", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "java", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "8e3f1bf87bc652a20de63bfd4952b16a", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "AnypointStudio", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "900c1fa84b4ea86537e1d148ee16eae8", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "Fuze", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "9811c1bb9f0f6835d5c13a831cca4173", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "node.js", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "a585c632a2b49be1256881fb0c16c864", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "Tableau", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "a5aa6e939e4770e3b8ac38ce414fd0d5", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "Slack", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "a61299f9b501adcf680b9275d79d4ac6", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "java", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "a7823092705a5e91ce2b7f561b6e5b98", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "Qsync Client", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "a9d17f74e55dd53fcf7c234f8a240919", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "Covenant Eyes", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "a9fead344bf3ac09f62df3cd9b22c268", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "java", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "ae340571b4fd0755c4a0821b18d8fa93", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "Google Earth", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "ba40fea2b2638908a3b3b482ac78d729", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "apple.geod,parsecd,apple.photomoments", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "bc0608d33dc64506b42f7f5f87958f37", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "cscan", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "be9f1360cf52dc1f61ae025252f192a3", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "Chromium", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "c048d9f26a79e11ca7276499ef24daf3", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "RescueTime,Plantronics Hub", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "c2b4710c6888a5d47befe865c8e6fb19", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "ZwiftApp", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "c376061f96329e1020865a1dc726927d", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "JavaApplicationStub", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "c46941d4de99445aef6b497679474cf4", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "geod", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "c5c11e6105c56fd29cc72c3ac7a2b78b", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "AT&T Connect", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "c882d9444412c00e71b643f3f54145ff", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "Creative Cloud", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "c9dbeed362a32f9a50a26f4d9b32bbd8", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "Messenger,Jumpshare", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "ccaa60f6ccc701bde536ef409be3cf63", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "curl no-SNI", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "cd7c06b9459c9cfd4af2dba5696ea930", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "Tableau", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "cdec81515ccc75a5aa41eb3db22226e6", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "BlueJeans,CEPHtmlEngine", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "d06acbe8ac31e753f40600a9d6717cba", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "Inbox OSX", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "d1f9f9b224387d2597f02095fcec96d7", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "hola_svc", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "d219efd07cbb8fbe547e6a5335843f0f", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "ruby", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "d27fb8deca6e3b9739db3fda2b229fe3", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "Google Drive File Stream", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "d732ca39155f38942f90e9fc2b0f97f7", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "Maxthon", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "d74778f454e2b047e030b291b94dd698", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "eclipse,java", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "def8761e4bcaaf91d99801a22ac6f6d4", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "Chromium", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "df65746370dcabc9b4f370c6e14a8156", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "True Key", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "e0224fc1c33658f2d3d963bfb0a76a85", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "Viber", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "e516ad69a423f8e0407307aa7bfd6344", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "Kindle,stack,nextcloud", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "e7d46c98b078477c4324031e0d3b22f5", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "Cisco AnyConnect Secure Mobility Client", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "e846898acc767ebeb2b4388e58a968d4", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "postbox-bin", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "eb149984fc9c44d85ed7f12c90d818be", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "Amazon Music,Dreamweaver,Spotify", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "ed36017db541879619c399c95e22067d", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "Cisco AnyConnect Secure Mobility Client", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "f059212ce3de94b1e8253a7522cb1b44", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "Google Photos Backup", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "f22bdd57e3a52de86cda40da2d84e83b", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "java,eclipse,Cyberduck", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "f28d34ce9e732f644de2350027d74c3f", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "Used by many programs,Quip,Aura,Spotify,Chatty", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "f6fd83a21f9f3c5f9ff7b5c63bbc179d", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "Alation Compose", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "f753495f2eab5155c61b760c838018f8", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "apple.geod", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "fa030dbcb2e3c7141d3c2803780ee8db", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "Battle.net,Dropbox", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "fa106fe5beec443af7e211ef8902e7e0", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "eclipse", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "fc5cb0985a5f5e295163cc8ffff8a6e1", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "Chromium", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "fd10cc8cce9493a966c57249e074755f", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "gramblr", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "fe048fe8faf797796e278f2b4f1e9c24", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "curl SNI", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "ff1040ba1e3d235855ef0d7cd9237fdc", "kind": "ja3", "tier": "curated", "classification": "api_client", "description": "hola_svc", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "002205d0f96c37c5e660b9f041363c11", "kind": "ja3", "tier": "curated", "classification": "browser", "description": "Google Chrome", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "073eede15b2a5a0302d823ecbd5ad15b", "kind": "ja3", "tier": "curated", "classification": "browser", "description": "Google Chrome", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "07b4162d4db57554961824a21c4a0fde", "kind": "ja3", "tier": "curated", "classification": "browser", "description": "firefox,thunderbird", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "0a81538cf247c104edb677bdb8902ed5", "kind": "ja3", "tier": "curated", "classification": "browser", "description": "firefox", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "0b61c673ee71fe9ee725bd687c455809", "kind": "ja3", "tier": "curated", "classification": "browser", "description": "Google Chrome", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "0b6592fd91d4843c823b75e49b43838d", "kind": "ja3", "tier": "curated", "classification": "browser", "description": "firefox", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "0e46737668fe75092919ee047a0b5945", "kind": "ja3", "tier": "curated", "classification": "browser", "description": "Google Chrome Helper", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "0ffee3ba8e615ad22535e7f771690a28", "kind": "ja3", "tier": "curated", "classification": "browser", "description": "firefox", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "1c15aca4a38bad90f9c40678f6aface9", "kind": "ja3", "tier": "curated", "classification": "browser", "description": "firefox", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "20dd18bdd3209ea718989030a6f93364", "kind": "ja3", "tier": "curated", "classification": "browser", "description": "Used by many programs,Slack,Postman,Spotify,Google Chrome", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "39fa85654105398ee7ef6a3a1c81d685", "kind": "ja3", "tier": "curated", "classification": "browser", "description": "Google Chrome Helper", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "3e4e87dda5a3162306609b7e330441d2", "kind": "ja3", "tier": "curated", "classification": "browser", "description": "apple.WebKit.Networking,itunesstored", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "3ee4aaac7147ff2b80ada31686db660c", "kind": "ja3", "tier": "curated", "classification": "browser", "description": "node-webkit,Kindle", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "40fd0a5e81ebdcf0ec82a4710a12dec1", "kind": "ja3", "tier": "curated", "classification": "browser", "description": "Used by many programs on OSX,apple.WebKit.Networking", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "474e73aea21d1e0910f25c3e6c178535", "kind": "ja3", "tier": "curated", "classification": "browser", "description": "apple.WebKit.Networking", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "4ba7b7022f5f5e1e500bb19199d8b1a4", "kind": "ja3", "tier": "curated", "classification": "browser", "description": "Google Chrome Helper", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "4c40bf8baa7c301c5dba8a20bc4119e2", "kind": "ja3", "tier": "curated", "classification": "browser", "description": "Dynalist,Postman,Google Chrome,Franz,GOG Galaxy", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "5163bc7c08f57077bc652ec370459c2f", "kind": "ja3", "tier": "curated", "classification": "browser", "description": "firefox", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "5498cef2cca704eb01cf2041cc1089c1", "kind": "ja3", "tier": "curated", "classification": "browser", "description": "Google Chrome,Slack", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "618ee2509ef52bf0b8216e1564eea909", "kind": "ja3", "tier": "curated", "classification": "browser", "description": "Used by many programs on OSX,apple.WebKit.Networking", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "61d0d709fe7ac199ef4b2c52bc8cef75", "kind": "ja3", "tier": "curated", "classification": "browser", "description": "firefox,thunderbird", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "63de2b6188d5694e79b678f585b13264", "kind": "ja3", "tier": "curated", "classification": "browser", "description": "apple.WebKit.Networking,Chatter,FieldServiceApp,socialstudio", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "6cd1b944f5885e2cfbe98a840b75eeb8", "kind": "ja3", "tier": "curated", "classification": "browser", "description": "Google Chrome", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "799135475da362592a4be9199d258726", "kind": "ja3", "tier": "curated", "classification": "browser", "description": "Used by many programs on OSX,apple.WebKit.Networking", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "7b343af1092863fdd822d6f10645abfb", "kind": "ja3", "tier": "curated", "classification": "browser", "description": "apple.WebKit.Networking,itunesstored", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "7b530a25af9016a9d12de5abc54d9e74", "kind": "ja3", "tier": "curated", "classification": "browser", "description": "Used by many programs on OSX,apple.WebKit.Networking", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "7e72698146290dd68239f788a452e7d8", "kind": "ja3", "tier": "curated", "classification": "browser", "description": "Used by many programs on OSX,apple.WebKit.Networking", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "8498fe4268764dbf926a38283e9d3d8f", "kind": "ja3", "tier": "curated", "classification": "browser", "description": "Franz,Google Chrome,Kiwi,Spotify,nwjs,Slack", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "8db4b0f8e9dd8f2fff38ee7c5a1e4496", "kind": "ja3", "tier": "curated", "classification": "browser", "description": "SpotlightNetHelper,Safari", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "94c485bca29d5392be53f2b8cf7f4304", "kind": "ja3", "tier": "curated", "classification": "browser", "description": "Google Chrome", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "a312f9162a08eeedf7feb7a13cd7e9bb", "kind": "ja3", "tier": "curated", "classification": "browser", "description": "apple.WebKit.Networking,Spotify,WhatsApp,Skype,iTunes", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "a88f1426c4603f2a8cd8bb41e875cb75", "kind": "ja3", "tier": "curated", "classification": "browser", "description": "firefox", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "a9aecaa66ad9c6cfe1c361da31768506", "kind": "ja3", "tier": "curated", "classification": "browser", "description": "Used by many programs on OSX,apple.WebKit.Networking", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "b03910cc6de801d2fcfa0c3b9f397df4", "kind": "ja3", "tier": "curated", "classification": "browser", "description": "firefox", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "b4f4e6164f938870486578536fc1ffce", "kind": "ja3", "tier": "curated", "classification": "browser", "description": "Google Chrome", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "b8f81673c0e1d29908346f3bab892b9b", "kind": "ja3", "tier": "curated", "classification": "browser", "description": "Google Chrome", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "baaac9b6bf25ad098115c71c59d29e51", "kind": "ja3", "tier": "curated", "classification": "browser", "description": "Google Chrome", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "bc6c386f480ee97b9d9e52d472b772d8", "kind": "ja3", "tier": "curated", "classification": "browser", "description": "Google Chrome", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "bfcc1a3891601edb4f137ab7ab25b840", "kind": "ja3", "tier": "curated", "classification": "browser", "description": "firefox", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "c05de18b01a054f2f6900ffe96b3da7a", "kind": "ja3", "tier": "curated", "classification": "browser", "description": "Used by many programs on OSX,apple.WebKit.Networking", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "c07cb55f88702033a8f52c046d23e0b2", "kind": "ja3", "tier": "curated", "classification": "browser", "description": "Used by many programs on OSX,apple.WebKit.Networking", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "c36fb08942cf19508c08d96af22d4ffc", "kind": "ja3", "tier": "curated", "classification": "browser", "description": "Safari", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "ce694315cbb81ce95e6ae4ae8cbafde6", "kind": "ja3", "tier": "curated", "classification": "browser", "description": "firefox", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "d4693422c5ce1565377aca25940ad80c", "kind": "ja3", "tier": "curated", "classification": "browser", "description": "apple.WebKit.Networking,CalendarAgent,Go for Gmail", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "da949afd9bd6df820730f8f171584a71", "kind": "ja3", "tier": "curated", "classification": "browser", "description": "Google Chrome", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "e4d448cdfe06dc1243c1eb026c74ac9a", "kind": "ja3", "tier": "curated", "classification": "browser", "description": "Used by many programs on OSX,apple.WebKit.Networking", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "eeeb5e7485f5e10cbc39db4cfb69b264", "kind": "ja3", "tier": "curated", "classification": "browser", "description": "apple.WebKit.Networking", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "f15797a734d0b4f171a86fd35c9a5e43", "kind": "ja3", "tier": "curated", "classification": "browser", "description": "firefox", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "f1c5cf087b959cec31bd6285407f689a", "kind": "ja3", "tier": "curated", "classification": "browser", "description": "Used by many programs on OSX,apple.WebKit.Networking", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "f58966d34ff9488a83797b55c804724d", "kind": "ja3", "tier": "curated", "classification": "browser", "description": "Google Chrome", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "fd6314b03413399e4f23d1524d206692", "kind": "ja3", "tier": "curated", "classification": "browser", "description": "Google Chrome", "ja4": null, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "t10d640300_13a2a23d501b_6bf8f498b543", "kind": "ja4", "tier": "curated", "classification": "scanner", "description": "nmap ssl-enum-ciphers, JA4 (stable across runs; observed 2026-07-31)", "ja4": { "a": "t10d640300", "b": "13a2a23d501b", "c": "6bf8f498b543", "properties": { "transport": "TCP", "tls_version": "TLS 1.0", "sni": "server name sent", "cipher_count": 64, "extension_count": 3, "alpn": null } }, "ja3_string": "769,8-6-3-147-148-182-172-149-183-173-49256-49262-49257-49263-49304-49298-49305-49299-52398-46-184-185-146-124-10-125-47-60-49308-49312-156-126-53-61-49309-49313-157-49212-49232-49213-49233-65-186-49274-132-192-49275-9-7-1-2-59-4-5-150-49180-49183-49186-49179-49182-49185-49178-49181-49184,10-0-11,23-24-25-29-256-4588,0", "ja3_decoded": { "version": { "value": 769, "name": "TLS 1.0" }, "ciphers": [ { "value": 8, "name": "8 (0x0008)", "known": false }, { "value": 6, "name": "6 (0x0006)", "known": false }, { "value": 3, "name": "3 (0x0003)", "known": false }, { "value": 147, "name": "147 (0x0093)", "known": false }, { "value": 148, "name": "148 (0x0094)", "known": false }, { "value": 182, "name": "182 (0x00b6)", "known": false }, { "value": 172, "name": "172 (0x00ac)", "known": false }, { "value": 149, "name": "149 (0x0095)", "known": false }, { "value": 183, "name": "183 (0x00b7)", "known": false }, { "value": 173, "name": "173 (0x00ad)", "known": false }, { "value": 49256, "name": "49256 (0xc068)", "known": false }, { "value": 49262, "name": "49262 (0xc06e)", "known": false }, { "value": 49257, "name": "49257 (0xc069)", "known": false }, { "value": 49263, "name": "49263 (0xc06f)", "known": false }, { "value": 49304, "name": "49304 (0xc098)", "known": false }, { "value": 49298, "name": "49298 (0xc092)", "known": false }, { "value": 49305, "name": "49305 (0xc099)", "known": false }, { "value": 49299, "name": "49299 (0xc093)", "known": false }, { "value": 52398, "name": "52398 (0xccae)", "known": false }, { "value": 46, "name": "46 (0x002e)", "known": false }, { "value": 184, "name": "184 (0x00b8)", "known": false }, { "value": 185, "name": "185 (0x00b9)", "known": false }, { "value": 146, "name": "146 (0x0092)", "known": false }, { "value": 124, "name": "124 (0x007c)", "known": false }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 125, "name": "125 (0x007d)", "known": false }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49308, "name": "TLS_DHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49312, "name": "TLS_ECDHE_ECDSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 126, "name": "126 (0x007e)", "known": false }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 49309, "name": "TLS_DHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49313, "name": "TLS_ECDHE_ECDSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49212, "name": "49212 (0xc03c)", "known": false }, { "value": 49232, "name": "49232 (0xc050)", "known": false }, { "value": 49213, "name": "49213 (0xc03d)", "known": false }, { "value": 49233, "name": "49233 (0xc051)", "known": false }, { "value": 65, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 186, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 49274, "name": "49274 (0xc07a)", "known": false }, { "value": 132, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 192, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA256", "known": true }, { "value": 49275, "name": "49275 (0xc07b)", "known": false }, { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 7, "name": "7 (0x0007)", "known": false }, { "value": 1, "name": "1 (0x0001)", "known": false }, { "value": 2, "name": "2 (0x0002)", "known": false }, { "value": 59, "name": "59 (0x003b)", "known": false }, { "value": 4, "name": "TLS_RSA_WITH_RC4_128_MD5", "known": true }, { "value": 5, "name": "TLS_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 150, "name": "TLS_RSA_WITH_SEED_CBC_SHA", "known": true }, { "value": 49180, "name": "49180 (0xc01c)", "known": false }, { "value": 49183, "name": "49183 (0xc01f)", "known": false }, { "value": 49186, "name": "49186 (0xc022)", "known": false }, { "value": 49179, "name": "49179 (0xc01b)", "known": false }, { "value": 49182, "name": "49182 (0xc01e)", "known": false }, { "value": 49185, "name": "49185 (0xc021)", "known": false }, { "value": 49178, "name": "49178 (0xc01a)", "known": false }, { "value": 49181, "name": "49181 (0xc01d)", "known": false }, { "value": 49184, "name": "49184 (0xc020)", "known": false } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 4588, "name": "SecP256r1MLKEM768", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 15, "first_seen": 1788710040, "last_seen": 1788842291, "transport": "t", "ja3_hash": "8f4558f961e7a3cf6353ec38ed7bed7f", "ja3_variant_count": 4, "ja3_variants": [ "8f4558f961e7a3cf6353ec38ed7bed7f", "a62471e0ef89283af324b0b17c4ba2d9", "1cf8794db2c63b873adec843db18e142", "1e04bd3007c72ce6c4708abaf5c26f86" ], "user_agents": [] } }, { "hash": "t10d640300_67f0ca237a44_6bf8f498b543", "kind": "ja4", "tier": "curated", "classification": "scanner", "description": "nmap ssl-enum-ciphers, JA4 (stable across runs; observed 2026-07-31)", "ja4": { "a": "t10d640300", "b": "67f0ca237a44", "c": "6bf8f498b543", "properties": { "transport": "TCP", "tls_version": "TLS 1.0", "sni": "server name sent", "cipher_count": 64, "extension_count": 3, "alpn": null } }, "ja3_string": "769,89-49173-49174-88-79-82-81-80-83-86-85-84-129-131-128-130-49410-49408-49409-41-38-42-39-43-40-35-31-34-30-37-33-36-32-0-49322-49323-139-140-174-49316-49320-168-141-175-49317-49321-169-49252-49258-49253-49259-49300-49294-49301-49295-52395-44-176-177-138-98-97-96-100,10-0-11,23-24-25-29-256-4588,0", "ja3_decoded": { "version": { "value": 769, "name": "TLS 1.0" }, "ciphers": [ { "value": 89, "name": "89 (0x0059)", "known": false }, { "value": 49173, "name": "49173 (0xc015)", "known": false }, { "value": 49174, "name": "49174 (0xc016)", "known": false }, { "value": 88, "name": "88 (0x0058)", "known": false }, { "value": 79, "name": "79 (0x004f)", "known": false }, { "value": 82, "name": "82 (0x0052)", "known": false }, { "value": 81, "name": "81 (0x0051)", "known": false }, { "value": 80, "name": "80 (0x0050)", "known": false }, { "value": 83, "name": "83 (0x0053)", "known": false }, { "value": 86, "name": "86 (0x0056)", "known": false }, { "value": 85, "name": "85 (0x0055)", "known": false }, { "value": 84, "name": "84 (0x0054)", "known": false }, { "value": 129, "name": "129 (0x0081)", "known": false }, { "value": 131, "name": "131 (0x0083)", "known": false }, { "value": 128, "name": "128 (0x0080)", "known": false }, { "value": 130, "name": "130 (0x0082)", "known": false }, { "value": 49410, "name": "49410 (0xc102)", "known": false }, { "value": 49408, "name": "49408 (0xc100)", "known": false }, { "value": 49409, "name": "49409 (0xc101)", "known": false }, { "value": 41, "name": "41 (0x0029)", "known": false }, { "value": 38, "name": "38 (0x0026)", "known": false }, { "value": 42, "name": "42 (0x002a)", "known": false }, { "value": 39, "name": "39 (0x0027)", "known": false }, { "value": 43, "name": "43 (0x002b)", "known": false }, { "value": 40, "name": "40 (0x0028)", "known": false }, { "value": 35, "name": "35 (0x0023)", "known": false }, { "value": 31, "name": "31 (0x001f)", "known": false }, { "value": 34, "name": "34 (0x0022)", "known": false }, { "value": 30, "name": "30 (0x001e)", "known": false }, { "value": 37, "name": "37 (0x0025)", "known": false }, { "value": 33, "name": "33 (0x0021)", "known": false }, { "value": 36, "name": "36 (0x0024)", "known": false }, { "value": 32, "name": "32 (0x0020)", "known": false }, { "value": 0, "name": "0 (0x0000)", "known": false }, { "value": 49322, "name": "49322 (0xc0aa)", "known": false }, { "value": 49323, "name": "49323 (0xc0ab)", "known": false }, { "value": 139, "name": "139 (0x008b)", "known": false }, { "value": 140, "name": "140 (0x008c)", "known": false }, { "value": 174, "name": "174 (0x00ae)", "known": false }, { "value": 49316, "name": "49316 (0xc0a4)", "known": false }, { "value": 49320, "name": "49320 (0xc0a8)", "known": false }, { "value": 168, "name": "168 (0x00a8)", "known": false }, { "value": 141, "name": "141 (0x008d)", "known": false }, { "value": 175, "name": "175 (0x00af)", "known": false }, { "value": 49317, "name": "49317 (0xc0a5)", "known": false }, { "value": 49321, "name": "49321 (0xc0a9)", "known": false }, { "value": 169, "name": "169 (0x00a9)", "known": false }, { "value": 49252, "name": "49252 (0xc064)", "known": false }, { "value": 49258, "name": "49258 (0xc06a)", "known": false }, { "value": 49253, "name": "49253 (0xc065)", "known": false }, { "value": 49259, "name": "49259 (0xc06b)", "known": false }, { "value": 49300, "name": "49300 (0xc094)", "known": false }, { "value": 49294, "name": "49294 (0xc08e)", "known": false }, { "value": 49301, "name": "49301 (0xc095)", "known": false }, { "value": 49295, "name": "49295 (0xc08f)", "known": false }, { "value": 52395, "name": "52395 (0xccab)", "known": false }, { "value": 44, "name": "44 (0x002c)", "known": false }, { "value": 176, "name": "176 (0x00b0)", "known": false }, { "value": 177, "name": "177 (0x00b1)", "known": false }, { "value": 138, "name": "138 (0x008a)", "known": false }, { "value": 98, "name": "98 (0x0062)", "known": false }, { "value": 97, "name": "97 (0x0061)", "known": false }, { "value": 96, "name": "96 (0x0060)", "known": false }, { "value": 100, "name": "100 (0x0064)", "known": false } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 4588, "name": "SecP256r1MLKEM768", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 15, "first_seen": 1788710035, "last_seen": 1788842285, "transport": "t", "ja3_hash": "60539ffbec08c42fcab2660f70ce21ca", "ja3_variant_count": 4, "ja3_variants": [ "60539ffbec08c42fcab2660f70ce21ca", "dda124905371562b72d28ea0e1364241", "a08c2570a9135eb2d9a7f1743196e091", "29f7908a42e8346e0f36114a59093e3f" ], "user_agents": [] } }, { "hash": "t10d640300_a3acda31d846_6bf8f498b543", "kind": "ja4", "tier": "curated", "classification": "scanner", "description": "nmap ssl-enum-ciphers, JA4 (stable across runs; observed 2026-07-31)", "ja4": { "a": "t10d640300", "b": "a3acda31d846", "c": "6bf8f498b543", "properties": { "transport": "TCP", "tls_version": "TLS 1.0", "sni": "server name sent", "cipher_count": 64, "extension_count": 3, "alpn": null } }, "ja3_string": "769,49311-49315-159-49220-49234-49221-49235-69-190-49276-136-196-49277-52394-52245-21-154-11-13-48-62-164-54-104-165-49214-49240-49215-49241-66-187-49282-133-193-49283-12-151-14-16-49-63-160-55-105-161-49216-49236-49217-49237-67-188-49278-134-194-49279-15-152-25-23-27-52-108-166-58,10-0-11,23-24-25-29-256-4588,0", "ja3_decoded": { "version": { "value": 769, "name": "TLS 1.0" }, "ciphers": [ { "value": 49311, "name": "TLS_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49315, "name": "TLS_ECDHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49220, "name": "49220 (0xc044)", "known": false }, { "value": 49234, "name": "49234 (0xc052)", "known": false }, { "value": 49221, "name": "49221 (0xc045)", "known": false }, { "value": 49235, "name": "49235 (0xc053)", "known": false }, { "value": 69, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 190, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 49276, "name": "49276 (0xc07c)", "known": false }, { "value": 136, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 196, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA256", "known": true }, { "value": 49277, "name": "49277 (0xc07d)", "known": false }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52245, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256 (draft)", "known": true }, { "value": 21, "name": "21 (0x0015)", "known": false }, { "value": 154, "name": "TLS_DHE_RSA_WITH_SEED_CBC_SHA", "known": true }, { "value": 11, "name": "11 (0x000b)", "known": false }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 48, "name": "48 (0x0030)", "known": false }, { "value": 62, "name": "62 (0x003e)", "known": false }, { "value": 164, "name": "164 (0x00a4)", "known": false }, { "value": 54, "name": "54 (0x0036)", "known": false }, { "value": 104, "name": "104 (0x0068)", "known": false }, { "value": 165, "name": "165 (0x00a5)", "known": false }, { "value": 49214, "name": "49214 (0xc03e)", "known": false }, { "value": 49240, "name": "49240 (0xc058)", "known": false }, { "value": 49215, "name": "49215 (0xc03f)", "known": false }, { "value": 49241, "name": "49241 (0xc059)", "known": false }, { "value": 66, "name": "66 (0x0042)", "known": false }, { "value": 187, "name": "187 (0x00bb)", "known": false }, { "value": 49282, "name": "49282 (0xc082)", "known": false }, { "value": 133, "name": "133 (0x0085)", "known": false }, { "value": 193, "name": "193 (0x00c1)", "known": false }, { "value": 49283, "name": "49283 (0xc083)", "known": false }, { "value": 12, "name": "12 (0x000c)", "known": false }, { "value": 151, "name": "151 (0x0097)", "known": false }, { "value": 14, "name": "14 (0x000e)", "known": false }, { "value": 16, "name": "16 (0x0010)", "known": false }, { "value": 49, "name": "49 (0x0031)", "known": false }, { "value": 63, "name": "63 (0x003f)", "known": false }, { "value": 160, "name": "160 (0x00a0)", "known": false }, { "value": 55, "name": "55 (0x0037)", "known": false }, { "value": 105, "name": "105 (0x0069)", "known": false }, { "value": 161, "name": "161 (0x00a1)", "known": false }, { "value": 49216, "name": "49216 (0xc040)", "known": false }, { "value": 49236, "name": "49236 (0xc054)", "known": false }, { "value": 49217, "name": "49217 (0xc041)", "known": false }, { "value": 49237, "name": "49237 (0xc055)", "known": false }, { "value": 67, "name": "67 (0x0043)", "known": false }, { "value": 188, "name": "188 (0x00bc)", "known": false }, { "value": 49278, "name": "49278 (0xc07e)", "known": false }, { "value": 134, "name": "134 (0x0086)", "known": false }, { "value": 194, "name": "194 (0x00c2)", "known": false }, { "value": 49279, "name": "49279 (0xc07f)", "known": false }, { "value": 15, "name": "15 (0x000f)", "known": false }, { "value": 152, "name": "152 (0x0098)", "known": false }, { "value": 25, "name": "25 (0x0019)", "known": false }, { "value": 23, "name": "23 (0x0017)", "known": false }, { "value": 27, "name": "27 (0x001b)", "known": false }, { "value": 52, "name": "52 (0x0034)", "known": false }, { "value": 108, "name": "108 (0x006c)", "known": false }, { "value": 166, "name": "166 (0x00a6)", "known": false }, { "value": 58, "name": "58 (0x003a)", "known": false } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 4588, "name": "SecP256r1MLKEM768", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 16, "first_seen": 1788710033, "last_seen": 1791020290, "transport": "t", "ja3_hash": "ddb64773428ea1a717a1db2c4adadc0c", "ja3_variant_count": 5, "ja3_variants": [ "ddb64773428ea1a717a1db2c4adadc0c", "8bd378bc6eb2437401966e9671e51f65", "84aa4572e2eed72a96b16dfd7540de28", "e8295a33a07fee21d46665a494a86d1c", "3976f066db858683d58700f6b20a65dc" ], "user_agents": [] } }, { "hash": "t10d640300_e31a90cd0803_6bf8f498b543", "kind": "ja4", "tier": "curated", "classification": "scanner", "description": "nmap ssl-enum-ciphers, JA4 (stable across runs; observed 2026-07-31)", "ja4": { "a": "t10d640300", "b": "e31a90cd0803", "c": "6bf8f498b543", "properties": { "transport": "TCP", "tls_version": "TLS 1.0", "sni": "server name sent", "cipher_count": 64, "extension_count": 3, "alpn": null } }, "ja3_string": "769,109-167-49222-49242-49223-49243-70-191-49284-137-197-49285-26-24-155-49330-49328-49331-49329-49160-49161-49187-49324-49326-49195-49162-49188-49325-49327-49196-49224-49244-49225-49245-49266-49286-49267-49287-52393-52244-49158-49159-49204-49205-49207-53251-53253-53249-49206-49208-53250-49264-49265-49306-49307-52396-49209-49210-49211-49203-49170-49171-49191-49199,10-0-11,23-24-25-29-256-4588,0", "ja3_decoded": { "version": { "value": 769, "name": "TLS 1.0" }, "ciphers": [ { "value": 109, "name": "109 (0x006d)", "known": false }, { "value": 167, "name": "167 (0x00a7)", "known": false }, { "value": 49222, "name": "49222 (0xc046)", "known": false }, { "value": 49242, "name": "49242 (0xc05a)", "known": false }, { "value": 49223, "name": "49223 (0xc047)", "known": false }, { "value": 49243, "name": "49243 (0xc05b)", "known": false }, { "value": 70, "name": "70 (0x0046)", "known": false }, { "value": 191, "name": "191 (0x00bf)", "known": false }, { "value": 49284, "name": "49284 (0xc084)", "known": false }, { "value": 137, "name": "137 (0x0089)", "known": false }, { "value": 197, "name": "197 (0x00c5)", "known": false }, { "value": 49285, "name": "49285 (0xc085)", "known": false }, { "value": 26, "name": "26 (0x001a)", "known": false }, { "value": 24, "name": "24 (0x0018)", "known": false }, { "value": 155, "name": "155 (0x009b)", "known": false }, { "value": 49330, "name": "TLS_DHE_RSA_WITH_AES_128_CCM_8", "known": true }, { "value": 49328, "name": "TLS_RSA_WITH_AES_128_CCM_8", "known": true }, { "value": 49331, "name": "TLS_DHE_RSA_WITH_AES_256_CCM_8", "known": true }, { "value": 49329, "name": "TLS_RSA_WITH_AES_256_CCM_8", "known": true }, { "value": 49160, "name": "TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49324, "name": "TLS_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49326, "name": "TLS_DHE_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49325, "name": "TLS_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49327, "name": "TLS_DHE_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49224, "name": "49224 (0xc048)", "known": false }, { "value": 49244, "name": "49244 (0xc05c)", "known": false }, { "value": 49225, "name": "49225 (0xc049)", "known": false }, { "value": 49245, "name": "49245 (0xc05d)", "known": false }, { "value": 49266, "name": "TLS_ECDHE_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 49286, "name": "49286 (0xc086)", "known": false }, { "value": 49267, "name": "TLS_ECDHE_RSA_WITH_CAMELLIA_256_CBC_SHA384", "known": true }, { "value": 49287, "name": "49287 (0xc087)", "known": false }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52244, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256 (draft)", "known": true }, { "value": 49158, "name": "49158 (0xc006)", "known": false }, { "value": 49159, "name": "TLS_ECDHE_ECDSA_WITH_RC4_128_SHA", "known": true }, { "value": 49204, "name": "49204 (0xc034)", "known": false }, { "value": 49205, "name": "49205 (0xc035)", "known": false }, { "value": 49207, "name": "49207 (0xc037)", "known": false }, { "value": 53251, "name": "53251 (0xd003)", "known": false }, { "value": 53253, "name": "53253 (0xd005)", "known": false }, { "value": 53249, "name": "53249 (0xd001)", "known": false }, { "value": 49206, "name": "49206 (0xc036)", "known": false }, { "value": 49208, "name": "49208 (0xc038)", "known": false }, { "value": 53250, "name": "53250 (0xd002)", "known": false }, { "value": 49264, "name": "49264 (0xc070)", "known": false }, { "value": 49265, "name": "49265 (0xc071)", "known": false }, { "value": 49306, "name": "49306 (0xc09a)", "known": false }, { "value": 49307, "name": "49307 (0xc09b)", "known": false }, { "value": 52396, "name": "52396 (0xccac)", "known": false }, { "value": 49209, "name": "49209 (0xc039)", "known": false }, { "value": 49210, "name": "49210 (0xc03a)", "known": false }, { "value": 49211, "name": "49211 (0xc03b)", "known": false }, { "value": 49203, "name": "49203 (0xc033)", "known": false }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 4588, "name": "SecP256r1MLKEM768", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 16, "first_seen": 1788710036, "last_seen": 1791020292, "transport": "t", "ja3_hash": "fa2ce5a3078abb9c449e8fbb1fe0ea6f", "ja3_variant_count": 5, "ja3_variants": [ "fa2ce5a3078abb9c449e8fbb1fe0ea6f", "24a712a9ef23f5d514e47fffb5596245", "12b636358ea66419c16709def10d17c4", "deb61e94362e500c8eefe17a507235dc", "b6e9cbc3dd73884ce74e3851203f09a5" ], "user_agents": [] } }, { "hash": "t10d640300_e7b476f9520b_6bf8f498b543", "kind": "ja4", "tier": "curated", "classification": "scanner", "description": "nmap ssl-enum-ciphers, JA4 (stable across runs; observed 2026-07-31)", "ja4": { "a": "t10d640300", "b": "e7b476f9520b", "c": "6bf8f498b543", "properties": { "transport": "TCP", "tls_version": "TLS 1.0", "sni": "server name sent", "cipher_count": 64, "extension_count": 3, "alpn": null } }, "ja3_string": "769,29-28-65279-65278-99-101-17-114-19-115-50-64-162-116-56-106-163-49218-49238-49219-49239-68-189-49280-135-195-49281-18-102-153-143-144-178-49318-170-145-179-49319-171-49254-49260-49255-49261-49302-49296-49303-49297-52397-45-180-181-142-20-119-22-120-51-103-49310-49314-158-121-57-107,10-0-11,23-24-25-29-256-4588,0", "ja3_decoded": { "version": { "value": 769, "name": "TLS 1.0" }, "ciphers": [ { "value": 29, "name": "29 (0x001d)", "known": false }, { "value": 28, "name": "28 (0x001c)", "known": false }, { "value": 65279, "name": "65279 (0xfeff)", "known": false }, { "value": 65278, "name": "65278 (0xfefe)", "known": false }, { "value": 99, "name": "99 (0x0063)", "known": false }, { "value": 101, "name": "101 (0x0065)", "known": false }, { "value": 17, "name": "17 (0x0011)", "known": false }, { "value": 114, "name": "114 (0x0072)", "known": false }, { "value": 19, "name": "19 (0x0013)", "known": false }, { "value": 115, "name": "115 (0x0073)", "known": false }, { "value": 50, "name": "50 (0x0032)", "known": false }, { "value": 64, "name": "64 (0x0040)", "known": false }, { "value": 162, "name": "162 (0x00a2)", "known": false }, { "value": 116, "name": "116 (0x0074)", "known": false }, { "value": 56, "name": "56 (0x0038)", "known": false }, { "value": 106, "name": "106 (0x006a)", "known": false }, { "value": 163, "name": "163 (0x00a3)", "known": false }, { "value": 49218, "name": "49218 (0xc042)", "known": false }, { "value": 49238, "name": "49238 (0xc056)", "known": false }, { "value": 49219, "name": "49219 (0xc043)", "known": false }, { "value": 49239, "name": "49239 (0xc057)", "known": false }, { "value": 68, "name": "68 (0x0044)", "known": false }, { "value": 189, "name": "189 (0x00bd)", "known": false }, { "value": 49280, "name": "49280 (0xc080)", "known": false }, { "value": 135, "name": "135 (0x0087)", "known": false }, { "value": 195, "name": "195 (0x00c3)", "known": false }, { "value": 49281, "name": "49281 (0xc081)", "known": false }, { "value": 18, "name": "18 (0x0012)", "known": false }, { "value": 102, "name": "102 (0x0066)", "known": false }, { "value": 153, "name": "153 (0x0099)", "known": false }, { "value": 143, "name": "143 (0x008f)", "known": false }, { "value": 144, "name": "144 (0x0090)", "known": false }, { "value": 178, "name": "178 (0x00b2)", "known": false }, { "value": 49318, "name": "49318 (0xc0a6)", "known": false }, { "value": 170, "name": "170 (0x00aa)", "known": false }, { "value": 145, "name": "145 (0x0091)", "known": false }, { "value": 179, "name": "179 (0x00b3)", "known": false }, { "value": 49319, "name": "49319 (0xc0a7)", "known": false }, { "value": 171, "name": "171 (0x00ab)", "known": false }, { "value": 49254, "name": "49254 (0xc066)", "known": false }, { "value": 49260, "name": "49260 (0xc06c)", "known": false }, { "value": 49255, "name": "49255 (0xc067)", "known": false }, { "value": 49261, "name": "49261 (0xc06d)", "known": false }, { "value": 49302, "name": "49302 (0xc096)", "known": false }, { "value": 49296, "name": "49296 (0xc090)", "known": false }, { "value": 49303, "name": "49303 (0xc097)", "known": false }, { "value": 49297, "name": "49297 (0xc091)", "known": false }, { "value": 52397, "name": "52397 (0xccad)", "known": false }, { "value": 45, "name": "45 (0x002d)", "known": false }, { "value": 180, "name": "180 (0x00b4)", "known": false }, { "value": 181, "name": "181 (0x00b5)", "known": false }, { "value": 142, "name": "142 (0x008e)", "known": false }, { "value": 20, "name": "20 (0x0014)", "known": false }, { "value": 119, "name": "119 (0x0077)", "known": false }, { "value": 22, "name": "TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 120, "name": "120 (0x0078)", "known": false }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49310, "name": "TLS_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49314, "name": "TLS_ECDHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 121, "name": "121 (0x0079)", "known": false }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 4588, "name": "SecP256r1MLKEM768", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 16, "first_seen": 1788710030, "last_seen": 1791020289, "transport": "t", "ja3_hash": "c2d96b3eccae65ca252907adb1ad4124", "ja3_variant_count": 5, "ja3_variants": [ "c2d96b3eccae65ca252907adb1ad4124", "7064e70dc94279db549fc80a14f5679a", "64f50b8bf471f53daa286f30e82ad40a", "c5f9dae86f8168fb85a1d40a368e9e37", "9b4bb3689b30a5131184c4e5b6caed1e" ], "user_agents": [] } }, { "hash": "t10d640300_f559eb9565fd_6bf8f498b543", "kind": "ja4", "tier": "curated", "classification": "scanner", "description": "nmap ssl-enum-ciphers, JA4 (stable across runs; observed 2026-07-31)", "ja4": { "a": "t10d640300", "b": "f559eb9565fd", "c": "6bf8f498b543", "properties": { "transport": "TCP", "tls_version": "TLS 1.0", "sni": "server name sent", "cipher_count": 64, "extension_count": 3, "alpn": null } }, "ja3_string": "769,49172-49192-49200-49228-49248-49229-49249-49270-49290-49271-49291-52392-52243-49168-49169-49155-74-49156-75-49189-49197-49157-76-49190-49198-49226-49246-49227-49247-49268-49288-49269-49289-73-49153-71-49154-72-78-77-49165-49166-49193-49201-49167-49194-49202-49230-49250-49231-49251-49272-49292-49273-49293-49163-49164-91-92-87-49175-90-49176-49177,10-0-11,23-24-25-29-256-4588,0", "ja3_decoded": { "version": { "value": 769, "name": "TLS 1.0" }, "ciphers": [ { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49228, "name": "49228 (0xc04c)", "known": false }, { "value": 49248, "name": "TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 49229, "name": "49229 (0xc04d)", "known": false }, { "value": 49249, "name": "TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_CBC_SHA384", "known": true }, { "value": 49270, "name": "TLS_RSA_WITH_CAMELLIA_128_GCM_SHA256", "known": true }, { "value": 49290, "name": "49290 (0xc08a)", "known": false }, { "value": 49271, "name": "TLS_RSA_WITH_CAMELLIA_256_GCM_SHA384", "known": true }, { "value": 49291, "name": "49291 (0xc08b)", "known": false }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52243, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 (draft)", "known": true }, { "value": 49168, "name": "49168 (0xc010)", "known": false }, { "value": 49169, "name": "TLS_ECDHE_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 49155, "name": "49155 (0xc003)", "known": false }, { "value": 74, "name": "74 (0x004a)", "known": false }, { "value": 49156, "name": "49156 (0xc004)", "known": false }, { "value": 75, "name": "75 (0x004b)", "known": false }, { "value": 49189, "name": "49189 (0xc025)", "known": false }, { "value": 49197, "name": "49197 (0xc02d)", "known": false }, { "value": 49157, "name": "49157 (0xc005)", "known": false }, { "value": 76, "name": "76 (0x004c)", "known": false }, { "value": 49190, "name": "49190 (0xc026)", "known": false }, { "value": 49198, "name": "49198 (0xc02e)", "known": false }, { "value": 49226, "name": "49226 (0xc04a)", "known": false }, { "value": 49246, "name": "49246 (0xc05e)", "known": false }, { "value": 49227, "name": "49227 (0xc04b)", "known": false }, { "value": 49247, "name": "49247 (0xc05f)", "known": false }, { "value": 49268, "name": "49268 (0xc074)", "known": false }, { "value": 49288, "name": "49288 (0xc088)", "known": false }, { "value": 49269, "name": "49269 (0xc075)", "known": false }, { "value": 49289, "name": "49289 (0xc089)", "known": false }, { "value": 73, "name": "73 (0x0049)", "known": false }, { "value": 49153, "name": "49153 (0xc001)", "known": false }, { "value": 71, "name": "71 (0x0047)", "known": false }, { "value": 49154, "name": "49154 (0xc002)", "known": false }, { "value": 72, "name": "72 (0x0048)", "known": false }, { "value": 78, "name": "78 (0x004e)", "known": false }, { "value": 77, "name": "77 (0x004d)", "known": false }, { "value": 49165, "name": "49165 (0xc00d)", "known": false }, { "value": 49166, "name": "49166 (0xc00e)", "known": false }, { "value": 49193, "name": "49193 (0xc029)", "known": false }, { "value": 49201, "name": "49201 (0xc031)", "known": false }, { "value": 49167, "name": "49167 (0xc00f)", "known": false }, { "value": 49194, "name": "49194 (0xc02a)", "known": false }, { "value": 49202, "name": "49202 (0xc032)", "known": false }, { "value": 49230, "name": "49230 (0xc04e)", "known": false }, { "value": 49250, "name": "49250 (0xc062)", "known": false }, { "value": 49231, "name": "49231 (0xc04f)", "known": false }, { "value": 49251, "name": "49251 (0xc063)", "known": false }, { "value": 49272, "name": "49272 (0xc078)", "known": false }, { "value": 49292, "name": "49292 (0xc08c)", "known": false }, { "value": 49273, "name": "49273 (0xc079)", "known": false }, { "value": 49293, "name": "49293 (0xc08d)", "known": false }, { "value": 49163, "name": "49163 (0xc00b)", "known": false }, { "value": 49164, "name": "49164 (0xc00c)", "known": false }, { "value": 91, "name": "91 (0x005b)", "known": false }, { "value": 92, "name": "92 (0x005c)", "known": false }, { "value": 87, "name": "87 (0x0057)", "known": false }, { "value": 49175, "name": "49175 (0xc017)", "known": false }, { "value": 90, "name": "90 (0x005a)", "known": false }, { "value": 49176, "name": "49176 (0xc018)", "known": false }, { "value": 49177, "name": "49177 (0xc019)", "known": false } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 4588, "name": "SecP256r1MLKEM768", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 16, "first_seen": 1788710034, "last_seen": 1791020291, "transport": "t", "ja3_hash": "e53f411daff3deced39ac87d3ef6e65a", "ja3_variant_count": 5, "ja3_variants": [ "e53f411daff3deced39ac87d3ef6e65a", "55559d24913a32b13e6559b0bc63295e", "4bc17aa9833ab551da3d2017dc0ecbf9", "ac618ad4c83155431a3876dd4ada6d79", "50c627686a4b44282980524beb64e906" ], "user_agents": [] } }, { "hash": "t11d640300_13a2a23d501b_6bf8f498b543", "kind": "ja4", "tier": "curated", "classification": "scanner", "description": "nmap ssl-enum-ciphers, JA4 (stable across runs; observed 2026-07-31)", "ja4": { "a": "t11d640300", "b": "13a2a23d501b", "c": "6bf8f498b543", "properties": { "transport": "TCP", "tls_version": "TLS 1.1", "sni": "server name sent", "cipher_count": 64, "extension_count": 3, "alpn": null } }, "ja3_string": "770,8-6-3-147-148-182-172-149-183-173-49256-49262-49257-49263-49304-49298-49305-49299-52398-46-184-185-146-124-10-125-47-60-49308-49312-156-126-53-61-49309-49313-157-49212-49232-49213-49233-65-186-49274-132-192-49275-9-7-1-2-59-4-5-150-49180-49183-49186-49179-49182-49185-49178-49181-49184,10-0-11,23-24-25-29-256-4588,0", "ja3_decoded": { "version": { "value": 770, "name": "TLS 1.1" }, "ciphers": [ { "value": 8, "name": "8 (0x0008)", "known": false }, { "value": 6, "name": "6 (0x0006)", "known": false }, { "value": 3, "name": "3 (0x0003)", "known": false }, { "value": 147, "name": "147 (0x0093)", "known": false }, { "value": 148, "name": "148 (0x0094)", "known": false }, { "value": 182, "name": "182 (0x00b6)", "known": false }, { "value": 172, "name": "172 (0x00ac)", "known": false }, { "value": 149, "name": "149 (0x0095)", "known": false }, { "value": 183, "name": "183 (0x00b7)", "known": false }, { "value": 173, "name": "173 (0x00ad)", "known": false }, { "value": 49256, "name": "49256 (0xc068)", "known": false }, { "value": 49262, "name": "49262 (0xc06e)", "known": false }, { "value": 49257, "name": "49257 (0xc069)", "known": false }, { "value": 49263, "name": "49263 (0xc06f)", "known": false }, { "value": 49304, "name": "49304 (0xc098)", "known": false }, { "value": 49298, "name": "49298 (0xc092)", "known": false }, { "value": 49305, "name": "49305 (0xc099)", "known": false }, { "value": 49299, "name": "49299 (0xc093)", "known": false }, { "value": 52398, "name": "52398 (0xccae)", "known": false }, { "value": 46, "name": "46 (0x002e)", "known": false }, { "value": 184, "name": "184 (0x00b8)", "known": false }, { "value": 185, "name": "185 (0x00b9)", "known": false }, { "value": 146, "name": "146 (0x0092)", "known": false }, { "value": 124, "name": "124 (0x007c)", "known": false }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 125, "name": "125 (0x007d)", "known": false }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49308, "name": "TLS_DHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49312, "name": "TLS_ECDHE_ECDSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 126, "name": "126 (0x007e)", "known": false }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 49309, "name": "TLS_DHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49313, "name": "TLS_ECDHE_ECDSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49212, "name": "49212 (0xc03c)", "known": false }, { "value": 49232, "name": "49232 (0xc050)", "known": false }, { "value": 49213, "name": "49213 (0xc03d)", "known": false }, { "value": 49233, "name": "49233 (0xc051)", "known": false }, { "value": 65, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 186, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 49274, "name": "49274 (0xc07a)", "known": false }, { "value": 132, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 192, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA256", "known": true }, { "value": 49275, "name": "49275 (0xc07b)", "known": false }, { "value": 9, "name": "9 (0x0009)", "known": false }, { "value": 7, "name": "7 (0x0007)", "known": false }, { "value": 1, "name": "1 (0x0001)", "known": false }, { "value": 2, "name": "2 (0x0002)", "known": false }, { "value": 59, "name": "59 (0x003b)", "known": false }, { "value": 4, "name": "TLS_RSA_WITH_RC4_128_MD5", "known": true }, { "value": 5, "name": "TLS_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 150, "name": "TLS_RSA_WITH_SEED_CBC_SHA", "known": true }, { "value": 49180, "name": "49180 (0xc01c)", "known": false }, { "value": 49183, "name": "49183 (0xc01f)", "known": false }, { "value": 49186, "name": "49186 (0xc022)", "known": false }, { "value": 49179, "name": "49179 (0xc01b)", "known": false }, { "value": 49182, "name": "49182 (0xc01e)", "known": false }, { "value": 49185, "name": "49185 (0xc021)", "known": false }, { "value": 49178, "name": "49178 (0xc01a)", "known": false }, { "value": 49181, "name": "49181 (0xc01d)", "known": false }, { "value": 49184, "name": "49184 (0xc020)", "known": false } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 4588, "name": "SecP256r1MLKEM768", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 15, "first_seen": 1788710037, "last_seen": 1788842287, "transport": "t", "ja3_hash": "8de9c7c43a53600a7b5e20dc77459331", "ja3_variant_count": 4, "ja3_variants": [ "8de9c7c43a53600a7b5e20dc77459331", "7281eb6b5b7a144d4aa9a87a2c63c45d", "bcac1c6a33bb1c7da989a42a27894e9b", "66295e0e528e74245f9f6ceb9de8e87d" ], "user_agents": [] } }, { "hash": "t11d640300_67f0ca237a44_6bf8f498b543", "kind": "ja4", "tier": "curated", "classification": "scanner", "description": "nmap ssl-enum-ciphers, JA4 (stable across runs; observed 2026-07-31)", "ja4": { "a": "t11d640300", "b": "67f0ca237a44", "c": "6bf8f498b543", "properties": { "transport": "TCP", "tls_version": "TLS 1.1", "sni": "server name sent", "cipher_count": 64, "extension_count": 3, "alpn": null } }, "ja3_string": "770,89-49173-49174-88-79-82-81-80-83-86-85-84-129-131-128-130-49410-49408-49409-41-38-42-39-43-40-35-31-34-30-37-33-36-32-0-49322-49323-139-140-174-49316-49320-168-141-175-49317-49321-169-49252-49258-49253-49259-49300-49294-49301-49295-52395-44-176-177-138-98-97-96-100,10-0-11,23-24-25-29-256-4588,0", "ja3_decoded": { "version": { "value": 770, "name": "TLS 1.1" }, "ciphers": [ { "value": 89, "name": "89 (0x0059)", "known": false }, { "value": 49173, "name": "49173 (0xc015)", "known": false }, { "value": 49174, "name": "49174 (0xc016)", "known": false }, { "value": 88, "name": "88 (0x0058)", "known": false }, { "value": 79, "name": "79 (0x004f)", "known": false }, { "value": 82, "name": "82 (0x0052)", "known": false }, { "value": 81, "name": "81 (0x0051)", "known": false }, { "value": 80, "name": "80 (0x0050)", "known": false }, { "value": 83, "name": "83 (0x0053)", "known": false }, { "value": 86, "name": "86 (0x0056)", "known": false }, { "value": 85, "name": "85 (0x0055)", "known": false }, { "value": 84, "name": "84 (0x0054)", "known": false }, { "value": 129, "name": "129 (0x0081)", "known": false }, { "value": 131, "name": "131 (0x0083)", "known": false }, { "value": 128, "name": "128 (0x0080)", "known": false }, { "value": 130, "name": "130 (0x0082)", "known": false }, { "value": 49410, "name": "49410 (0xc102)", "known": false }, { "value": 49408, "name": "49408 (0xc100)", "known": false }, { "value": 49409, "name": "49409 (0xc101)", "known": false }, { "value": 41, "name": "41 (0x0029)", "known": false }, { "value": 38, "name": "38 (0x0026)", "known": false }, { "value": 42, "name": "42 (0x002a)", "known": false }, { "value": 39, "name": "39 (0x0027)", "known": false }, { "value": 43, "name": "43 (0x002b)", "known": false }, { "value": 40, "name": "40 (0x0028)", "known": false }, { "value": 35, "name": "35 (0x0023)", "known": false }, { "value": 31, "name": "31 (0x001f)", "known": false }, { "value": 34, "name": "34 (0x0022)", "known": false }, { "value": 30, "name": "30 (0x001e)", "known": false }, { "value": 37, "name": "37 (0x0025)", "known": false }, { "value": 33, "name": "33 (0x0021)", "known": false }, { "value": 36, "name": "36 (0x0024)", "known": false }, { "value": 32, "name": "32 (0x0020)", "known": false }, { "value": 0, "name": "0 (0x0000)", "known": false }, { "value": 49322, "name": "49322 (0xc0aa)", "known": false }, { "value": 49323, "name": "49323 (0xc0ab)", "known": false }, { "value": 139, "name": "139 (0x008b)", "known": false }, { "value": 140, "name": "140 (0x008c)", "known": false }, { "value": 174, "name": "174 (0x00ae)", "known": false }, { "value": 49316, "name": "49316 (0xc0a4)", "known": false }, { "value": 49320, "name": "49320 (0xc0a8)", "known": false }, { "value": 168, "name": "168 (0x00a8)", "known": false }, { "value": 141, "name": "141 (0x008d)", "known": false }, { "value": 175, "name": "175 (0x00af)", "known": false }, { "value": 49317, "name": "49317 (0xc0a5)", "known": false }, { "value": 49321, "name": "49321 (0xc0a9)", "known": false }, { "value": 169, "name": "169 (0x00a9)", "known": false }, { "value": 49252, "name": "49252 (0xc064)", "known": false }, { "value": 49258, "name": "49258 (0xc06a)", "known": false }, { "value": 49253, "name": "49253 (0xc065)", "known": false }, { "value": 49259, "name": "49259 (0xc06b)", "known": false }, { "value": 49300, "name": "49300 (0xc094)", "known": false }, { "value": 49294, "name": "49294 (0xc08e)", "known": false }, { "value": 49301, "name": "49301 (0xc095)", "known": false }, { "value": 49295, "name": "49295 (0xc08f)", "known": false }, { "value": 52395, "name": "52395 (0xccab)", "known": false }, { "value": 44, "name": "44 (0x002c)", "known": false }, { "value": 176, "name": "176 (0x00b0)", "known": false }, { "value": 177, "name": "177 (0x00b1)", "known": false }, { "value": 138, "name": "138 (0x008a)", "known": false }, { "value": 98, "name": "98 (0x0062)", "known": false }, { "value": 97, "name": "97 (0x0061)", "known": false }, { "value": 96, "name": "96 (0x0060)", "known": false }, { "value": 100, "name": "100 (0x0064)", "known": false } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 4588, "name": "SecP256r1MLKEM768", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 15, "first_seen": 1788710042, "last_seen": 1788842292, "transport": "t", "ja3_hash": "77d8246c50a0c1f2d98525dcea42ef29", "ja3_variant_count": 4, "ja3_variants": [ "77d8246c50a0c1f2d98525dcea42ef29", "40af735e9c434f039760391a794d3aa2", "8c86fd6889132179662580ad6e8780a2", "eed78583a98688831893f81d05e27c82" ], "user_agents": [] } }, { "hash": "t11d640300_a3acda31d846_6bf8f498b543", "kind": "ja4", "tier": "curated", "classification": "scanner", "description": "nmap ssl-enum-ciphers, JA4 (stable across runs; observed 2026-07-31)", "ja4": { "a": "t11d640300", "b": "a3acda31d846", "c": "6bf8f498b543", "properties": { "transport": "TCP", "tls_version": "TLS 1.1", "sni": "server name sent", "cipher_count": 64, "extension_count": 3, "alpn": null } }, "ja3_string": "770,49311-49315-159-49220-49234-49221-49235-69-190-49276-136-196-49277-52394-52245-21-154-11-13-48-62-164-54-104-165-49214-49240-49215-49241-66-187-49282-133-193-49283-12-151-14-16-49-63-160-55-105-161-49216-49236-49217-49237-67-188-49278-134-194-49279-15-152-25-23-27-52-108-166-58,10-0-11,23-24-25-29-256-4588,0", "ja3_decoded": { "version": { "value": 770, "name": "TLS 1.1" }, "ciphers": [ { "value": 49311, "name": "TLS_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49315, "name": "TLS_ECDHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49220, "name": "49220 (0xc044)", "known": false }, { "value": 49234, "name": "49234 (0xc052)", "known": false }, { "value": 49221, "name": "49221 (0xc045)", "known": false }, { "value": 49235, "name": "49235 (0xc053)", "known": false }, { "value": 69, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 190, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 49276, "name": "49276 (0xc07c)", "known": false }, { "value": 136, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 196, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA256", "known": true }, { "value": 49277, "name": "49277 (0xc07d)", "known": false }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52245, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256 (draft)", "known": true }, { "value": 21, "name": "21 (0x0015)", "known": false }, { "value": 154, "name": "TLS_DHE_RSA_WITH_SEED_CBC_SHA", "known": true }, { "value": 11, "name": "11 (0x000b)", "known": false }, { "value": 13, "name": "13 (0x000d)", "known": false }, { "value": 48, "name": "48 (0x0030)", "known": false }, { "value": 62, "name": "62 (0x003e)", "known": false }, { "value": 164, "name": "164 (0x00a4)", "known": false }, { "value": 54, "name": "54 (0x0036)", "known": false }, { "value": 104, "name": "104 (0x0068)", "known": false }, { "value": 165, "name": "165 (0x00a5)", "known": false }, { "value": 49214, "name": "49214 (0xc03e)", "known": false }, { "value": 49240, "name": "49240 (0xc058)", "known": false }, { "value": 49215, "name": "49215 (0xc03f)", "known": false }, { "value": 49241, "name": "49241 (0xc059)", "known": false }, { "value": 66, "name": "66 (0x0042)", "known": false }, { "value": 187, "name": "187 (0x00bb)", "known": false }, { "value": 49282, "name": "49282 (0xc082)", "known": false }, { "value": 133, "name": "133 (0x0085)", "known": false }, { "value": 193, "name": "193 (0x00c1)", "known": false }, { "value": 49283, "name": "49283 (0xc083)", "known": false }, { "value": 12, "name": "12 (0x000c)", "known": false }, { "value": 151, "name": "151 (0x0097)", "known": false }, { "value": 14, "name": "14 (0x000e)", "known": false }, { "value": 16, "name": "16 (0x0010)", "known": false }, { "value": 49, "name": "49 (0x0031)", "known": false }, { "value": 63, "name": "63 (0x003f)", "known": false }, { "value": 160, "name": "160 (0x00a0)", "known": false }, { "value": 55, "name": "55 (0x0037)", "known": false }, { "value": 105, "name": "105 (0x0069)", "known": false }, { "value": 161, "name": "161 (0x00a1)", "known": false }, { "value": 49216, "name": "49216 (0xc040)", "known": false }, { "value": 49236, "name": "49236 (0xc054)", "known": false }, { "value": 49217, "name": "49217 (0xc041)", "known": false }, { "value": 49237, "name": "49237 (0xc055)", "known": false }, { "value": 67, "name": "67 (0x0043)", "known": false }, { "value": 188, "name": "188 (0x00bc)", "known": false }, { "value": 49278, "name": "49278 (0xc07e)", "known": false }, { "value": 134, "name": "134 (0x0086)", "known": false }, { "value": 194, "name": "194 (0x00c2)", "known": false }, { "value": 49279, "name": "49279 (0xc07f)", "known": false }, { "value": 15, "name": "15 (0x000f)", "known": false }, { "value": 152, "name": "152 (0x0098)", "known": false }, { "value": 25, "name": "25 (0x0019)", "known": false }, { "value": 23, "name": "23 (0x0017)", "known": false }, { "value": 27, "name": "27 (0x001b)", "known": false }, { "value": 52, "name": "52 (0x0034)", "known": false }, { "value": 108, "name": "108 (0x006c)", "known": false }, { "value": 166, "name": "166 (0x00a6)", "known": false }, { "value": 58, "name": "58 (0x003a)", "known": false } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 4588, "name": "SecP256r1MLKEM768", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 16, "first_seen": 1788710039, "last_seen": 1791020289, "transport": "t", "ja3_hash": "520978d10abe048e7109ae4ae07c6c7b", "ja3_variant_count": 5, "ja3_variants": [ "520978d10abe048e7109ae4ae07c6c7b", "cecf4f0a803718be652f9fa623105a0a", "c6110e78375b92ff48e1b450c22a3c88", "0bf272196481d0da5f4730cd63f1fa57", "cc514bde9d1c3ae13be916c06e51cca8" ], "user_agents": [] } }, { "hash": "t11d640300_e31a90cd0803_6bf8f498b543", "kind": "ja4", "tier": "curated", "classification": "scanner", "description": "nmap ssl-enum-ciphers, JA4 (stable across runs; observed 2026-07-31)", "ja4": { "a": "t11d640300", "b": "e31a90cd0803", "c": "6bf8f498b543", "properties": { "transport": "TCP", "tls_version": "TLS 1.1", "sni": "server name sent", "cipher_count": 64, "extension_count": 3, "alpn": null } }, "ja3_string": "770,109-167-49222-49242-49223-49243-70-191-49284-137-197-49285-26-24-155-49330-49328-49331-49329-49160-49161-49187-49324-49326-49195-49162-49188-49325-49327-49196-49224-49244-49225-49245-49266-49286-49267-49287-52393-52244-49158-49159-49204-49205-49207-53251-53253-53249-49206-49208-53250-49264-49265-49306-49307-52396-49209-49210-49211-49203-49170-49171-49191-49199,10-0-11,23-24-25-29-256-4588,0", "ja3_decoded": { "version": { "value": 770, "name": "TLS 1.1" }, "ciphers": [ { "value": 109, "name": "109 (0x006d)", "known": false }, { "value": 167, "name": "167 (0x00a7)", "known": false }, { "value": 49222, "name": "49222 (0xc046)", "known": false }, { "value": 49242, "name": "49242 (0xc05a)", "known": false }, { "value": 49223, "name": "49223 (0xc047)", "known": false }, { "value": 49243, "name": "49243 (0xc05b)", "known": false }, { "value": 70, "name": "70 (0x0046)", "known": false }, { "value": 191, "name": "191 (0x00bf)", "known": false }, { "value": 49284, "name": "49284 (0xc084)", "known": false }, { "value": 137, "name": "137 (0x0089)", "known": false }, { "value": 197, "name": "197 (0x00c5)", "known": false }, { "value": 49285, "name": "49285 (0xc085)", "known": false }, { "value": 26, "name": "26 (0x001a)", "known": false }, { "value": 24, "name": "24 (0x0018)", "known": false }, { "value": 155, "name": "155 (0x009b)", "known": false }, { "value": 49330, "name": "TLS_DHE_RSA_WITH_AES_128_CCM_8", "known": true }, { "value": 49328, "name": "TLS_RSA_WITH_AES_128_CCM_8", "known": true }, { "value": 49331, "name": "TLS_DHE_RSA_WITH_AES_256_CCM_8", "known": true }, { "value": 49329, "name": "TLS_RSA_WITH_AES_256_CCM_8", "known": true }, { "value": 49160, "name": "TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49324, "name": "TLS_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49326, "name": "TLS_DHE_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49325, "name": "TLS_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49327, "name": "TLS_DHE_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49224, "name": "49224 (0xc048)", "known": false }, { "value": 49244, "name": "49244 (0xc05c)", "known": false }, { "value": 49225, "name": "49225 (0xc049)", "known": false }, { "value": 49245, "name": "49245 (0xc05d)", "known": false }, { "value": 49266, "name": "TLS_ECDHE_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 49286, "name": "49286 (0xc086)", "known": false }, { "value": 49267, "name": "TLS_ECDHE_RSA_WITH_CAMELLIA_256_CBC_SHA384", "known": true }, { "value": 49287, "name": "49287 (0xc087)", "known": false }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52244, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256 (draft)", "known": true }, { "value": 49158, "name": "49158 (0xc006)", "known": false }, { "value": 49159, "name": "TLS_ECDHE_ECDSA_WITH_RC4_128_SHA", "known": true }, { "value": 49204, "name": "49204 (0xc034)", "known": false }, { "value": 49205, "name": "49205 (0xc035)", "known": false }, { "value": 49207, "name": "49207 (0xc037)", "known": false }, { "value": 53251, "name": "53251 (0xd003)", "known": false }, { "value": 53253, "name": "53253 (0xd005)", "known": false }, { "value": 53249, "name": "53249 (0xd001)", "known": false }, { "value": 49206, "name": "49206 (0xc036)", "known": false }, { "value": 49208, "name": "49208 (0xc038)", "known": false }, { "value": 53250, "name": "53250 (0xd002)", "known": false }, { "value": 49264, "name": "49264 (0xc070)", "known": false }, { "value": 49265, "name": "49265 (0xc071)", "known": false }, { "value": 49306, "name": "49306 (0xc09a)", "known": false }, { "value": 49307, "name": "49307 (0xc09b)", "known": false }, { "value": 52396, "name": "52396 (0xccac)", "known": false }, { "value": 49209, "name": "49209 (0xc039)", "known": false }, { "value": 49210, "name": "49210 (0xc03a)", "known": false }, { "value": 49211, "name": "49211 (0xc03b)", "known": false }, { "value": 49203, "name": "49203 (0xc033)", "known": false }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 4588, "name": "SecP256r1MLKEM768", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 16, "first_seen": 1788710037, "last_seen": 1791020290, "transport": "t", "ja3_hash": "fdb52e11d68966be00fcb1347073e39a", "ja3_variant_count": 5, "ja3_variants": [ "fdb52e11d68966be00fcb1347073e39a", "b3d1bc7b276289d815dd513730dc61eb", "f625e4df6b7d68d7aacf37641c956175", "c3f81d67d0e52f81c773e0f62ee1ac4b", "a8c28a398a2a8a9d405d6f19397047f2" ], "user_agents": [] } }, { "hash": "t11d640300_e7b476f9520b_6bf8f498b543", "kind": "ja4", "tier": "curated", "classification": "scanner", "description": "nmap ssl-enum-ciphers, JA4 (stable across runs; observed 2026-07-31)", "ja4": { "a": "t11d640300", "b": "e7b476f9520b", "c": "6bf8f498b543", "properties": { "transport": "TCP", "tls_version": "TLS 1.1", "sni": "server name sent", "cipher_count": 64, "extension_count": 3, "alpn": null } }, "ja3_string": "770,29-28-65279-65278-99-101-17-114-19-115-50-64-162-116-56-106-163-49218-49238-49219-49239-68-189-49280-135-195-49281-18-102-153-143-144-178-49318-170-145-179-49319-171-49254-49260-49255-49261-49302-49296-49303-49297-52397-45-180-181-142-20-119-22-120-51-103-49310-49314-158-121-57-107,10-0-11,23-24-25-29-256-4588,0", "ja3_decoded": { "version": { "value": 770, "name": "TLS 1.1" }, "ciphers": [ { "value": 29, "name": "29 (0x001d)", "known": false }, { "value": 28, "name": "28 (0x001c)", "known": false }, { "value": 65279, "name": "65279 (0xfeff)", "known": false }, { "value": 65278, "name": "65278 (0xfefe)", "known": false }, { "value": 99, "name": "99 (0x0063)", "known": false }, { "value": 101, "name": "101 (0x0065)", "known": false }, { "value": 17, "name": "17 (0x0011)", "known": false }, { "value": 114, "name": "114 (0x0072)", "known": false }, { "value": 19, "name": "19 (0x0013)", "known": false }, { "value": 115, "name": "115 (0x0073)", "known": false }, { "value": 50, "name": "50 (0x0032)", "known": false }, { "value": 64, "name": "64 (0x0040)", "known": false }, { "value": 162, "name": "162 (0x00a2)", "known": false }, { "value": 116, "name": "116 (0x0074)", "known": false }, { "value": 56, "name": "56 (0x0038)", "known": false }, { "value": 106, "name": "106 (0x006a)", "known": false }, { "value": 163, "name": "163 (0x00a3)", "known": false }, { "value": 49218, "name": "49218 (0xc042)", "known": false }, { "value": 49238, "name": "49238 (0xc056)", "known": false }, { "value": 49219, "name": "49219 (0xc043)", "known": false }, { "value": 49239, "name": "49239 (0xc057)", "known": false }, { "value": 68, "name": "68 (0x0044)", "known": false }, { "value": 189, "name": "189 (0x00bd)", "known": false }, { "value": 49280, "name": "49280 (0xc080)", "known": false }, { "value": 135, "name": "135 (0x0087)", "known": false }, { "value": 195, "name": "195 (0x00c3)", "known": false }, { "value": 49281, "name": "49281 (0xc081)", "known": false }, { "value": 18, "name": "18 (0x0012)", "known": false }, { "value": 102, "name": "102 (0x0066)", "known": false }, { "value": 153, "name": "153 (0x0099)", "known": false }, { "value": 143, "name": "143 (0x008f)", "known": false }, { "value": 144, "name": "144 (0x0090)", "known": false }, { "value": 178, "name": "178 (0x00b2)", "known": false }, { "value": 49318, "name": "49318 (0xc0a6)", "known": false }, { "value": 170, "name": "170 (0x00aa)", "known": false }, { "value": 145, "name": "145 (0x0091)", "known": false }, { "value": 179, "name": "179 (0x00b3)", "known": false }, { "value": 49319, "name": "49319 (0xc0a7)", "known": false }, { "value": 171, "name": "171 (0x00ab)", "known": false }, { "value": 49254, "name": "49254 (0xc066)", "known": false }, { "value": 49260, "name": "49260 (0xc06c)", "known": false }, { "value": 49255, "name": "49255 (0xc067)", "known": false }, { "value": 49261, "name": "49261 (0xc06d)", "known": false }, { "value": 49302, "name": "49302 (0xc096)", "known": false }, { "value": 49296, "name": "49296 (0xc090)", "known": false }, { "value": 49303, "name": "49303 (0xc097)", "known": false }, { "value": 49297, "name": "49297 (0xc091)", "known": false }, { "value": 52397, "name": "52397 (0xccad)", "known": false }, { "value": 45, "name": "45 (0x002d)", "known": false }, { "value": 180, "name": "180 (0x00b4)", "known": false }, { "value": 181, "name": "181 (0x00b5)", "known": false }, { "value": 142, "name": "142 (0x008e)", "known": false }, { "value": 20, "name": "20 (0x0014)", "known": false }, { "value": 119, "name": "119 (0x0077)", "known": false }, { "value": 22, "name": "TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 120, "name": "120 (0x0078)", "known": false }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49310, "name": "TLS_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49314, "name": "TLS_ECDHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 121, "name": "121 (0x0079)", "known": false }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 4588, "name": "SecP256r1MLKEM768", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 16, "first_seen": 1788710039, "last_seen": 1791020290, "transport": "t", "ja3_hash": "dc3c9110c7a2cd3a24fa387147dd1779", "ja3_variant_count": 5, "ja3_variants": [ "dc3c9110c7a2cd3a24fa387147dd1779", "499a39d0686735e11bf4641098545dc4", "f0e9c8866d60282351c447d53ad69a0c", "416dacce2e6f8ee14248d993ed769de9", "90870570f66aeea1a1ec68c09cca7229" ], "user_agents": [] } }, { "hash": "t11d640300_f559eb9565fd_6bf8f498b543", "kind": "ja4", "tier": "curated", "classification": "scanner", "description": "nmap ssl-enum-ciphers, JA4 (stable across runs; observed 2026-07-31)", "ja4": { "a": "t11d640300", "b": "f559eb9565fd", "c": "6bf8f498b543", "properties": { "transport": "TCP", "tls_version": "TLS 1.1", "sni": "server name sent", "cipher_count": 64, "extension_count": 3, "alpn": null } }, "ja3_string": "770,49172-49192-49200-49228-49248-49229-49249-49270-49290-49271-49291-52392-52243-49168-49169-49155-74-49156-75-49189-49197-49157-76-49190-49198-49226-49246-49227-49247-49268-49288-49269-49289-73-49153-71-49154-72-78-77-49165-49166-49193-49201-49167-49194-49202-49230-49250-49231-49251-49272-49292-49273-49293-49163-49164-91-92-87-49175-90-49176-49177,10-0-11,23-24-25-29-256-4588,0", "ja3_decoded": { "version": { "value": 770, "name": "TLS 1.1" }, "ciphers": [ { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49228, "name": "49228 (0xc04c)", "known": false }, { "value": 49248, "name": "TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 49229, "name": "49229 (0xc04d)", "known": false }, { "value": 49249, "name": "TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_CBC_SHA384", "known": true }, { "value": 49270, "name": "TLS_RSA_WITH_CAMELLIA_128_GCM_SHA256", "known": true }, { "value": 49290, "name": "49290 (0xc08a)", "known": false }, { "value": 49271, "name": "TLS_RSA_WITH_CAMELLIA_256_GCM_SHA384", "known": true }, { "value": 49291, "name": "49291 (0xc08b)", "known": false }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52243, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 (draft)", "known": true }, { "value": 49168, "name": "49168 (0xc010)", "known": false }, { "value": 49169, "name": "TLS_ECDHE_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 49155, "name": "49155 (0xc003)", "known": false }, { "value": 74, "name": "74 (0x004a)", "known": false }, { "value": 49156, "name": "49156 (0xc004)", "known": false }, { "value": 75, "name": "75 (0x004b)", "known": false }, { "value": 49189, "name": "49189 (0xc025)", "known": false }, { "value": 49197, "name": "49197 (0xc02d)", "known": false }, { "value": 49157, "name": "49157 (0xc005)", "known": false }, { "value": 76, "name": "76 (0x004c)", "known": false }, { "value": 49190, "name": "49190 (0xc026)", "known": false }, { "value": 49198, "name": "49198 (0xc02e)", "known": false }, { "value": 49226, "name": "49226 (0xc04a)", "known": false }, { "value": 49246, "name": "49246 (0xc05e)", "known": false }, { "value": 49227, "name": "49227 (0xc04b)", "known": false }, { "value": 49247, "name": "49247 (0xc05f)", "known": false }, { "value": 49268, "name": "49268 (0xc074)", "known": false }, { "value": 49288, "name": "49288 (0xc088)", "known": false }, { "value": 49269, "name": "49269 (0xc075)", "known": false }, { "value": 49289, "name": "49289 (0xc089)", "known": false }, { "value": 73, "name": "73 (0x0049)", "known": false }, { "value": 49153, "name": "49153 (0xc001)", "known": false }, { "value": 71, "name": "71 (0x0047)", "known": false }, { "value": 49154, "name": "49154 (0xc002)", "known": false }, { "value": 72, "name": "72 (0x0048)", "known": false }, { "value": 78, "name": "78 (0x004e)", "known": false }, { "value": 77, "name": "77 (0x004d)", "known": false }, { "value": 49165, "name": "49165 (0xc00d)", "known": false }, { "value": 49166, "name": "49166 (0xc00e)", "known": false }, { "value": 49193, "name": "49193 (0xc029)", "known": false }, { "value": 49201, "name": "49201 (0xc031)", "known": false }, { "value": 49167, "name": "49167 (0xc00f)", "known": false }, { "value": 49194, "name": "49194 (0xc02a)", "known": false }, { "value": 49202, "name": "49202 (0xc032)", "known": false }, { "value": 49230, "name": "49230 (0xc04e)", "known": false }, { "value": 49250, "name": "49250 (0xc062)", "known": false }, { "value": 49231, "name": "49231 (0xc04f)", "known": false }, { "value": 49251, "name": "49251 (0xc063)", "known": false }, { "value": 49272, "name": "49272 (0xc078)", "known": false }, { "value": 49292, "name": "49292 (0xc08c)", "known": false }, { "value": 49273, "name": "49273 (0xc079)", "known": false }, { "value": 49293, "name": "49293 (0xc08d)", "known": false }, { "value": 49163, "name": "49163 (0xc00b)", "known": false }, { "value": 49164, "name": "49164 (0xc00c)", "known": false }, { "value": 91, "name": "91 (0x005b)", "known": false }, { "value": 92, "name": "92 (0x005c)", "known": false }, { "value": 87, "name": "87 (0x0057)", "known": false }, { "value": 49175, "name": "49175 (0xc017)", "known": false }, { "value": 90, "name": "90 (0x005a)", "known": false }, { "value": 49176, "name": "49176 (0xc018)", "known": false }, { "value": 49177, "name": "49177 (0xc019)", "known": false } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 4588, "name": "SecP256r1MLKEM768", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 16, "first_seen": 1788710039, "last_seen": 1791020289, "transport": "t", "ja3_hash": "627e21d18e5721958c0c7ae774b71231", "ja3_variant_count": 5, "ja3_variants": [ "627e21d18e5721958c0c7ae774b71231", "d4e98f040b64040e4249d6870af72345", "d8b071c520af654d2540d1ec71dbc680", "cc69b70d7a5c8f329b8894480122e802", "ea4a9b49f2b7805426249dfda2975607" ], "user_agents": [] } }, { "hash": "t12d190600_9c2f387b437f_82b0993b6ad8", "kind": "ja4", "tier": "curated", "classification": "scanner", "description": "nmap ssl-enum-ciphers, JA4 (stable across runs; observed 2026-07-31)", "ja4": { "a": "t12d190600", "b": "9c2f387b437f", "c": "82b0993b6ad8", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 19, "extension_count": 6, "alpn": null } }, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "t12d640400_13a2a23d501b_3549fbaf615c", "kind": "ja4", "tier": "curated", "classification": "scanner", "description": "nmap ssl-enum-ciphers, JA4 (stable across runs; observed 2026-07-31)", "ja4": { "a": "t12d640400", "b": "13a2a23d501b", "c": "3549fbaf615c", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 64, "extension_count": 4, "alpn": null } }, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "t12d640400_67f0ca237a44_3549fbaf615c", "kind": "ja4", "tier": "curated", "classification": "scanner", "description": "nmap ssl-enum-ciphers, JA4 (stable across runs; observed 2026-07-31)", "ja4": { "a": "t12d640400", "b": "67f0ca237a44", "c": "3549fbaf615c", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 64, "extension_count": 4, "alpn": null } }, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "t12d640400_a3acda31d846_3549fbaf615c", "kind": "ja4", "tier": "curated", "classification": "scanner", "description": "nmap ssl-enum-ciphers, JA4 (stable across runs; observed 2026-07-31)", "ja4": { "a": "t12d640400", "b": "a3acda31d846", "c": "3549fbaf615c", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 64, "extension_count": 4, "alpn": null } }, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "t12d640400_e31a90cd0803_3549fbaf615c", "kind": "ja4", "tier": "curated", "classification": "scanner", "description": "nmap ssl-enum-ciphers, JA4 (stable across runs; observed 2026-07-31)", "ja4": { "a": "t12d640400", "b": "e31a90cd0803", "c": "3549fbaf615c", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 64, "extension_count": 4, "alpn": null } }, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "t12d640400_e7b476f9520b_3549fbaf615c", "kind": "ja4", "tier": "curated", "classification": "scanner", "description": "nmap ssl-enum-ciphers, JA4 (stable across runs; observed 2026-07-31)", "ja4": { "a": "t12d640400", "b": "e7b476f9520b", "c": "3549fbaf615c", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 64, "extension_count": 4, "alpn": null } }, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "t12d640400_f559eb9565fd_3549fbaf615c", "kind": "ja4", "tier": "curated", "classification": "scanner", "description": "nmap ssl-enum-ciphers, JA4 (stable across runs; observed 2026-07-31)", "ja4": { "a": "t12d640400", "b": "f559eb9565fd", "c": "3549fbaf615c", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 64, "extension_count": 4, "alpn": null } }, "ja3_string": null, "ja3_decoded": null, "observed": null }, { "hash": "q13d0311h3_55b375c5d22e_e3b8e4ce5af0", "kind": "ja4", "tier": "observed", "classification": "api_client", "description": "quic-go \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "q13d0311h3", "b": "55b375c5d22e", "c": "e3b8e4ce5af0", "properties": { "transport": "QUIC", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 3, "extension_count": 11, "alpn": "h3" } }, "ja3_string": "771,4865-4866-4867,0-5-10-11-13-65281-16-18-43-51-57,29-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 57, "name": "quic_transport_parameters", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 94, "first_seen": 1787535362, "last_seen": 1791571217, "transport": "q", "ja3_hash": "3e9680842aa1ac1f48edc74e779ebc97", "ja3_variant_count": 1, "ja3_variants": [ "3e9680842aa1ac1f48edc74e779ebc97" ], "user_agents": { "quic-go-HTTP/3": 94 }, "ua_disagreement": false } }, { "hash": "q13d0313h3_55b375c5d22e_557329848ba7", "kind": "ja4", "tier": "observed", "classification": "api_client", "description": "curl \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "q13d0313h3", "b": "55b375c5d22e", "c": "557329848ba7", "properties": { "transport": "QUIC", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 3, "extension_count": 13, "alpn": "h3" } }, "ja3_string": "771,4866-4867-4865,57-0-11-10-16-22-23-49-13-43-45-51-27,4588-29-23-30-24-25-256-257,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true } ], "extensions": [ { "value": 57, "name": "quic_transport_parameters", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 49, "name": "post_handshake_auth", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 27, "name": "compress_certificate", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 4, "first_seen": 1790511642, "last_seen": 1791125311, "transport": "q", "ja3_hash": "f7c4c8ab987ac48634bec91f3c21a227", "ja3_variant_count": 1, "ja3_variants": [ "f7c4c8ab987ac48634bec91f3c21a227" ], "user_agents": { "curl/8.19.0": 4 }, "ua_disagreement": false } }, { "hash": "q13d0411h3_16476d049b0b_8d0f06507a4e", "kind": "ja4", "tier": "observed", "classification": "api_client", "description": "curl \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "q13d0411h3", "b": "16476d049b0b", "c": "8d0f06507a4e", "properties": { "transport": "QUIC", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 4, "extension_count": 11, "alpn": "h3" } }, "ja3_string": "771,4866-4867-4865-255,0-10-16-22-23-49-13-43-45-51-57,4588,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 49, "name": "post_handshake_auth", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 57, "name": "quic_transport_parameters", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true } ], "point_formats": [] }, "observed": { "count": 2, "first_seen": 1788989702, "last_seen": 1788989721, "transport": "q", "ja3_hash": "d77d6df709f1b67a8e4c5c97a28518c5", "ja3_variant_count": 1, "ja3_variants": [ "d77d6df709f1b67a8e4c5c97a28518c5" ], "user_agents": { "curl/8.18.0-DEV": 2 }, "ua_disagreement": false } }, { "hash": "t12d080700_0df93f53a2f9_b871c60bacbc", "kind": "ja4", "tier": "observed", "classification": "api_client", "description": "Shares its JA4_c (b871c60bacbc) with 1 fingerprint classified as api_client, and nothing else in that family disagrees \u2014 the same tool under different cipher options. Inferred from the family, not observed directly.", "ja4": { "a": "t12d080700", "b": "0df93f53a2f9", "c": "b871c60bacbc", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 8, "extension_count": 7, "alpn": null } }, "ja3_string": "771,49200-49199-49192-49191-49196-49195-49188-49187,0-10-11-13-35-23-65281,24-23,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true } ], "curves": [ { "value": 24, "name": "secp384r1", "known": true }, { "value": 23, "name": "secp256r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 4, "first_seen": 1789575261, "last_seen": 1789578538, "transport": "t", "ja3_hash": "5b0ffbfa2ef37b8d4e4953c76f689d77", "ja3_variant_count": 1, "ja3_variants": [ "5b0ffbfa2ef37b8d4e4953c76f689d77" ], "user_agents": [], "ua_disagreement": false }, "inferred_from_family": true }, { "hash": "t12d150400_8daaf6152771_93b9751e4c3e", "kind": "ja4", "tier": "observed", "classification": "api_client", "description": "Sogou spider \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150400", "b": "8daaf6152771", "c": "93b9751e4c3e", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-10-0-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789130278, "last_seen": 1789130278, "transport": "t", "ja3_hash": "e921bfee618b8399a0f03c6bfc1842f8", "ja3_variant_count": 1, "ja3_variants": [ "e921bfee618b8399a0f03c6bfc1842f8" ], "user_agents": { "Sogou web spider/4.0(+http://www.sogou.com/docs/help/webmasters.htm#07)": 11 }, "ua_disagreement": false } }, { "hash": "t12d151000_8daaf6152771_ee4b244473e1", "kind": "ja4", "tier": "observed", "classification": "api_client", "description": "Sogou spider \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d151000", "b": "8daaf6152771", "c": "ee4b244473e1", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-13-10-11-65037-27-0-23-18-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791231310, "last_seen": 1791231310, "transport": "t", "ja3_hash": "136556117973c472f1080913507e1324", "ja3_variant_count": 1, "ja3_variants": [ "136556117973c472f1080913507e1324" ], "user_agents": { "Sogou web spider/4.0(+http://www.sogou.com/docs/help/webmasters.htm#07)": 12 }, "ua_disagreement": false } }, { "hash": "t12d1510h2_8daaf6152771_7f2e73375223", "kind": "ja4", "tier": "observed", "classification": "api_client", "description": "PerplexityBot \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1510h2", "b": "8daaf6152771", "c": "7f2e73375223", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-35-0-10-11-27-13-5-16-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790286319, "last_seen": 1790286319, "transport": "t", "ja3_hash": "5b7f6f514be450f630aca37259df314b", "ja3_variant_count": 1, "ja3_variants": [ "5b7f6f514be450f630aca37259df314b" ], "user_agents": { "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; PerplexityBot/1.0; +https://perplexity.ai/perplexitybot)": 2, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36; compatible; OAI-SearchBot/1.4; +https://openai.com/searchbot": 1, "Mozilla/5.0 (compatible; Bravebot/1.0; +https://brave.com/search/)": 2 }, "ua_disagreement": true } }, { "hash": "t12d1510h2_8daaf6152771_f54ed08efad8", "kind": "ja4", "tier": "observed", "classification": "api_client", "description": "Sogou spider \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1510h2", "b": "8daaf6152771", "c": "f54ed08efad8", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-0-65281-65037-16-18-5-35-45-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790338582, "last_seen": 1790338582, "transport": "t", "ja3_hash": "a9e4b8658467023ddd89b133831b61c4", "ja3_variant_count": 1, "ja3_variants": [ "a9e4b8658467023ddd89b133831b61c4" ], "user_agents": { "Sogou web spider/4.0(+http://www.sogou.com/docs/help/webmasters.htm#07)": 12 }, "ua_disagreement": false } }, { "hash": "t12d1512h2_8daaf6152771_0247d2492af2", "kind": "ja4", "tier": "observed", "classification": "api_client", "description": "Sogou spider \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1512h2", "b": "8daaf6152771", "c": "0247d2492af2", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-23-18-11-0-17613-16-65281-35-45-13-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790731482, "last_seen": 1790731482, "transport": "t", "ja3_hash": "5bf726a1313ab7b82bd552cc316e8010", "ja3_variant_count": 1, "ja3_variants": [ "5bf726a1313ab7b82bd552cc316e8010" ], "user_agents": { "Sogou web spider/4.0(+http://www.sogou.com/docs/help/webmasters.htm#07)": 12 }, "ua_disagreement": false } }, { "hash": "t12d151300_8daaf6152771_002c0579dc72", "kind": "ja4", "tier": "observed", "classification": "api_client", "description": "Sogou spider \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d151300", "b": "8daaf6152771", "c": "002c0579dc72", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-11-65281-45-35-18-27-0-65037-23-17613-10-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789699345, "last_seen": 1789699345, "transport": "t", "ja3_hash": "92c244e203cd171a7bb1ab8e0ff617f2", "ja3_variant_count": 1, "ja3_variants": [ "92c244e203cd171a7bb1ab8e0ff617f2" ], "user_agents": { "Sogou web spider/4.0(+http://www.sogou.com/docs/help/webmasters.htm#07)": 11 }, "ua_disagreement": false } }, { "hash": "t12d180700_4b22cbed5bed_b871c60bacbc", "kind": "ja4", "tier": "observed", "classification": "api_client", "description": "Shares its JA4_c (b871c60bacbc) with 1 fingerprint classified as api_client, and nothing else in that family disagrees \u2014 the same tool under different cipher options. Inferred from the family, not observed directly.", "ja4": { "a": "t12d180700", "b": "4b22cbed5bed", "c": "b871c60bacbc", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 18, "extension_count": 7, "alpn": null } }, "ja3_string": "771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47,0-10-11-13-35-23-65281,29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 32, "first_seen": 1788460403, "last_seen": 1791564045, "transport": "t", "ja3_hash": "6a5d235ee78c6aede6a61448b4e9ff1e", "ja3_variant_count": 1, "ja3_variants": [ "6a5d235ee78c6aede6a61448b4e9ff1e" ], "user_agents": [], "ua_disagreement": false }, "inferred_from_family": true }, { "hash": "t12d180800_5d04281c6031_021da7cd3809", "kind": "ja4", "tier": "observed", "classification": "api_client", "description": "Claude-User \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d180800", "b": "5d04281c6031", "c": "021da7cd3809", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 18, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49199-49195-49200-49196-49191-52393-52392-49161-49171-49162-49172-156-157-47-53,0-23-65281-10-11-35-13-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 5, "first_seen": 1788489052, "last_seen": 1791292783, "transport": "t", "ja3_hash": "e422b48cc39491764bf12f66fdef4771", "ja3_variant_count": 1, "ja3_variants": [ "e422b48cc39491764bf12f66fdef4771" ], "user_agents": { "Claude-User (claude-code/2.1.278; +https://support.anthropic.com/)": 2, "Claude-User (claude-code/2.1.286; +https://support.anthropic.com/)": 3, "Claude-User (claude-code/2.1.255; +https://support.anthropic.com/)": 1 }, "ua_disagreement": false } }, { "hash": "t12d200700_22c523c4c553_b871c60bacbc", "kind": "ja4", "tier": "observed", "classification": "api_client", "description": "Shares its JA4_c (b871c60bacbc) with 1 fingerprint classified as api_client, and nothing else in that family disagrees \u2014 the same tool under different cipher options. Inferred from the family, not observed directly.", "ja4": { "a": "t12d200700", "b": "22c523c4c553", "c": "b871c60bacbc", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 20, "extension_count": 7, "alpn": null } }, "ja3_string": "771,49196-49195-49200-49199-159-158-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47,0-10-11-13-35-23-65281,29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 111, "first_seen": 1787451571, "last_seen": 1791423931, "transport": "t", "ja3_hash": "095a9cdf6fceacc9c38736015b7d1ec4", "ja3_variant_count": 1, "ja3_variants": [ "095a9cdf6fceacc9c38736015b7d1ec4" ], "user_agents": [], "ua_disagreement": false }, "inferred_from_family": true }, { "hash": "t12d210700_76e208dd3e22_b871c60bacbc", "kind": "ja4", "tier": "observed", "classification": "api_client", "description": "Seen in live traffic; not in the curated database.", "ja4": { "a": "t12d210700", "b": "76e208dd3e22", "c": "b871c60bacbc", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 21, "extension_count": 7, "alpn": null } }, "ja3_string": "771,49196-49195-49200-49199-159-158-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-23-65281,29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 271, "first_seen": 1787464642, "last_seen": 1791514984, "transport": "t", "ja3_hash": "3b5074b1b5d032e5620f69f9f700ff0e", "ja3_variant_count": 1, "ja3_variants": [ "3b5074b1b5d032e5620f69f9f700ff0e" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12i1504h2_8daaf6152771_18ecb20ebe77", "kind": "ja4", "tier": "observed", "classification": "api_client", "description": "Sogou spider \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1504h2", "b": "8daaf6152771", "c": "18ecb20ebe77", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 4, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-16-65281-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791273417, "last_seen": 1791273417, "transport": "t", "ja3_hash": "b0e5ad26f2f622776d704eab3f355b33", "ja3_variant_count": 1, "ja3_variants": [ "b0e5ad26f2f622776d704eab3f355b33" ], "user_agents": { "Sogou web spider/4.0(+http://www.sogou.com/docs/help/webmasters.htm#07)": 12 }, "ua_disagreement": false } }, { "hash": "t12i1504h2_8daaf6152771_ce6db83f2c68", "kind": "ja4", "tier": "observed", "classification": "api_client", "description": "Sogou spider \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1504h2", "b": "8daaf6152771", "c": "ce6db83f2c68", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 4, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-51-18-0,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 0, "name": "server_name", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789431215, "last_seen": 1789431215, "transport": "t", "ja3_hash": "0418de22d706e126bef1088d93cb9de4", "ja3_variant_count": 1, "ja3_variants": [ "0418de22d706e126bef1088d93cb9de4" ], "user_agents": { "Sogou web spider/4.0(+http://www.sogou.com/docs/help/webmasters.htm#07)": 1 }, "ua_disagreement": false } }, { "hash": "t12i150500_8daaf6152771_6399a569455a", "kind": "ja4", "tier": "observed", "classification": "api_client", "description": "Sogou spider \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150500", "b": "8daaf6152771", "c": "6399a569455a", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-18-65281-51-10,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 10, "name": "supported_groups", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790513168, "last_seen": 1790513168, "transport": "t", "ja3_hash": "9fb8cd6b40f18752a8b5c7c3cafae118", "ja3_variant_count": 1, "ja3_variants": [ "9fb8cd6b40f18752a8b5c7c3cafae118" ], "user_agents": { "Sogou web spider/4.0(+http://www.sogou.com/docs/help/webmasters.htm#07)": 12 }, "ua_disagreement": false } }, { "hash": "t12i150500_8daaf6152771_6ae18c926a97", "kind": "ja4", "tier": "observed", "classification": "api_client", "description": "Sogou spider \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150500", "b": "8daaf6152771", "c": "6ae18c926a97", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-51-10-18-0,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 0, "name": "server_name", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789816512, "last_seen": 1789816512, "transport": "t", "ja3_hash": "29e69b087bb9d3b2a10923480d265244", "ja3_variant_count": 1, "ja3_variants": [ "29e69b087bb9d3b2a10923480d265244" ], "user_agents": { "Sogou web spider/4.0": 23 }, "ua_disagreement": false } }, { "hash": "t12i150500_8daaf6152771_c9644b0143dc", "kind": "ja4", "tier": "observed", "classification": "api_client", "description": "Sogou spider \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150500", "b": "8daaf6152771", "c": "c9644b0143dc", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-17613-51-23-65037,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790569400, "last_seen": 1790569400, "transport": "t", "ja3_hash": "883e006b95ceafa29866aafc0bc24779", "ja3_variant_count": 1, "ja3_variants": [ "883e006b95ceafa29866aafc0bc24779" ], "user_agents": { "Sogou web spider/4.0(+http://www.sogou.com/docs/help/webmasters.htm#07)": 12 }, "ua_disagreement": false } }, { "hash": "t12i150500_8daaf6152771_f74b1484f78c", "kind": "ja4", "tier": "observed", "classification": "api_client", "description": "Sogou spider \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i150500", "b": "8daaf6152771", "c": "f74b1484f78c", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-65281-23-5-11,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789695449, "last_seen": 1789695449, "transport": "t", "ja3_hash": "35419aadc6bfdff2d43a3ab9671eb8cb", "ja3_variant_count": 1, "ja3_variants": [ "35419aadc6bfdff2d43a3ab9671eb8cb" ], "user_agents": { "Sogou web spider/4.0(+http://www.sogou.com/docs/help/webmasters.htm#07)": 1 }, "ua_disagreement": false } }, { "hash": "t12i1507h2_8daaf6152771_11627799d1d4", "kind": "ja4", "tier": "observed", "classification": "api_client", "description": "Sogou spider \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1507h2", "b": "8daaf6152771", "c": "11627799d1d4", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-17613-16-65281-23-65037-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789097064, "last_seen": 1789097064, "transport": "t", "ja3_hash": "92303393732623c2e67d5fe434e7ba81", "ja3_variant_count": 1, "ja3_variants": [ "92303393732623c2e67d5fe434e7ba81" ], "user_agents": { "Sogou web spider/4.0(+http://www.sogou.com/docs/help/webmasters.htm#07)": 11 }, "ua_disagreement": false } }, { "hash": "t12i1508h2_8daaf6152771_3a59c9940562", "kind": "ja4", "tier": "observed", "classification": "api_client", "description": "Sogou spider \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1508h2", "b": "8daaf6152771", "c": "3a59c9940562", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 8, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-11-65037-16-35-45-5-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789702689, "last_seen": 1789702689, "transport": "t", "ja3_hash": "904514155566cdc487937059d0e81c9b", "ja3_variant_count": 1, "ja3_variants": [ "904514155566cdc487937059d0e81c9b" ], "user_agents": { "Sogou web spider/4.0(+http://www.sogou.com/docs/help/webmasters.htm#07)": 11 }, "ua_disagreement": false } }, { "hash": "t12i1509h2_8daaf6152771_97e3b743d3ba", "kind": "ja4", "tier": "observed", "classification": "api_client", "description": "Sogou spider \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12i1509h2", "b": "8daaf6152771", "c": "97e3b743d3ba", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-65281-16-5-45-10-11-65037-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789665447, "last_seen": 1789665447, "transport": "t", "ja3_hash": "55fce89808c1ac6c3eb02e8d30422dbd", "ja3_variant_count": 1, "ja3_variants": [ "55fce89808c1ac6c3eb02e8d30422dbd" ], "user_agents": { "Sogou web spider/4.0(+http://www.sogou.com/docs/help/webmasters.htm#07)": 11 }, "ua_disagreement": false } }, { "hash": "t13d031200_55b375c5d22e_55ac72f97122", "kind": "ja4", "tier": "observed", "classification": "api_client", "description": "Python aiohttp \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d031200", "b": "55b375c5d22e", "c": "55ac72f97122", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 3, "extension_count": 12, "alpn": null } }, "ja3_string": "771,4866-4867-4865,65281-0-11-10-35-22-23-13-43-45-51-27,4588-29-23-30-24-25-256-257,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 27, "name": "compress_certificate", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 5, "first_seen": 1788725716, "last_seen": 1790398075, "transport": "t", "ja3_hash": "1c48fac858875a4fce78dde2a602b093", "ja3_variant_count": 1, "ja3_variants": [ "1c48fac858875a4fce78dde2a602b093" ], "user_agents": { "Python/3.11 aiohttp/3.14.3": 4 }, "ua_disagreement": false } }, { "hash": "t13d0312h2_55b375c5d22e_8da9a2619b0b", "kind": "ja4", "tier": "observed", "classification": "api_client", "description": "curl \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d0312h2", "b": "55b375c5d22e", "c": "8da9a2619b0b", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 3, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4866-4867-4865,65281-0-10-16-22-23-49-13-43-45-51-27,514,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 49, "name": "post_handshake_auth", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 27, "name": "compress_certificate", "known": true } ], "curves": [ { "value": 514, "name": "514 (0x0202)", "known": false } ], "point_formats": [] }, "observed": { "count": 2, "first_seen": 1791323246, "last_seen": 1791323844, "transport": "t", "ja3_hash": "f505c740c6b5cc76bbdb6ae65ddf62ad", "ja3_variant_count": 1, "ja3_variants": [ "f505c740c6b5cc76bbdb6ae65ddf62ad" ], "user_agents": { "curl/8.18.0": 2 }, "ua_disagreement": false } }, { "hash": "t13d0312h2_55b375c5d22e_91cb082f3657", "kind": "ja4", "tier": "observed", "classification": "api_client", "description": "curl \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d0312h2", "b": "55b375c5d22e", "c": "91cb082f3657", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 3, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4866-4867-4865,0-11-10-16-22-23-49-13-43-45-51-27,4588-29-23-30-24-25-256-257,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 49, "name": "post_handshake_auth", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 27, "name": "compress_certificate", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788725708, "last_seen": 1788725708, "transport": "t", "ja3_hash": "d24be7db5080cb337fcc018702787f84", "ja3_variant_count": 1, "ja3_variants": [ "d24be7db5080cb337fcc018702787f84" ], "user_agents": { "curl/8.18.0": 1 }, "ua_disagreement": false } }, { "hash": "t13d0313h2_55b375c5d22e_90ed1dadcdd2", "kind": "ja4", "tier": "observed", "classification": "api_client", "description": "curl \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d0313h2", "b": "55b375c5d22e", "c": "90ed1dadcdd2", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 3, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4866-4867-4865,65281-0-11-10-16-22-23-49-13-43-45-51-27,4588-29-23-30-24-25-256-257,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 49, "name": "post_handshake_auth", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 27, "name": "compress_certificate", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 2, "first_seen": 1791323248, "last_seen": 1791323846, "transport": "t", "ja3_hash": "9f74b0a625c106ce58a596a90ae450d4", "ja3_variant_count": 1, "ja3_variants": [ "9f74b0a625c106ce58a596a90ae450d4" ], "user_agents": { "curl/8.18.0": 1, "Mozilla/5.0": 1 }, "ua_disagreement": false } }, { "hash": "t13d101000_61a7ad8aa9b6_01def6fbf02e", "kind": "ja4", "tier": "observed", "classification": "api_client", "description": "PerplexityBot \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d101000", "b": "61a7ad8aa9b6", "c": "01def6fbf02e", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 10, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4866-4865-4867-49196-49195-52393-49200-49199-52392-255,23-5-13-10-0-35-43-51-11-45,29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 220, "first_seen": 1787567855, "last_seen": 1791348515, "transport": "t", "ja3_hash": "d819bfceb5b843d1b942ccc74894b673", "ja3_variant_count": 197, "ja3_variants": [ "d819bfceb5b843d1b942ccc74894b673", "b8850b280182f5b275a80670c3dd72c5", "1ecb20e35f039d74cddacbbcc9d4e1ff", "5331fcdb53219bd752bba158703f4a12", "f97564838f0fda84748d2ae04ca992dd", "2e0e92b90c8e79e19fbcc7652a348bb8", "4e1a75cd7222bb2ca9ca2a9b889abf57", "6a15043f593bcd30c22970c194cd5cf2", "1387ce8a0d028da1f7be8cb5447018b4", "ae4de56710d6b80f000e5dca3d8fbef0", "eeaf414f702fd599b5b5f7f4e2cf21c1", "caed531980cd3c3d081316fe1032ff07" ], "user_agents": { "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; PerplexityBot/1.0; +https://perplexity.ai/perplexitybot)": 20, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36": 2 }, "ua_disagreement": true } }, { "hash": "t13d101000_61a7ad8aa9b6_815af8d700c8", "kind": "ja4", "tier": "observed", "classification": "api_client", "description": "PerplexityBot \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d101000", "b": "61a7ad8aa9b6", "c": "815af8d700c8", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 10, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4866-4865-4867-49196-49195-52393-49200-49199-52392-255,11-13-23-0-51-35-10-43-5-45,29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 6, "first_seen": 1789652060, "last_seen": 1791315171, "transport": "t", "ja3_hash": "ef18f791c09a7ee259889d68618961ca", "ja3_variant_count": 5, "ja3_variants": [ "ef18f791c09a7ee259889d68618961ca", "690dcf0eff78c40c4c67bfc235041555", "08d4b80ccbe1ed3b2517d94c5862770a", "6eb63241f84df2b18084f68770a6e6e2", "1f5f9b42226c3bbbf8965dcf1bb66bb7" ], "user_agents": { "ccfetch/1.0": 5, "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; PerplexityBot/1.0; +https://perplexity.ai/perplexitybot)": 1 }, "ua_disagreement": false } }, { "hash": "t13d101000_61a7ad8aa9b6_c46b846b2fb1", "kind": "ja4", "tier": "observed", "classification": "api_client", "description": "PerplexityBot \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d101000", "b": "61a7ad8aa9b6", "c": "c46b846b2fb1", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 10, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4866-4865-4867-49196-49195-52393-49200-49199-52392-255,45-11-35-10-43-13-23-5-0-51,29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 4624, "first_seen": 1787716860, "last_seen": 1791558827, "transport": "t", "ja3_hash": "3af2e09bef4eb5670a57ce98d09e15cf", "ja3_variant_count": 4426, "ja3_variants": [ "3af2e09bef4eb5670a57ce98d09e15cf", "213819a8d711c5c4ff6449894ed6eb3e", "469624846357eeae24a45cf3a32e35d1", "ec06a85ac0b133c81d3bbe86fcda9ce6", "0f35a03dc7fed491915ce3b0a3f50591", "c6d2f25f581f4be83211a89f44534a62", "421333b37578de97c184d09c783752cb", "b573b1767e2b6290c151f932ac51a911", "4f02e906801688df0fb0565396aba3c0", "234f5210705421e0d56cd73ca16d16f0", "10a0a3dd8288028d3f339514b2621c13", "a7e6adf63482f9d2b0e11bcbccc59a36" ], "user_agents": { "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; PerplexityBot/1.0; +https://perplexity.ai/perplexitybot)": 4609, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36": 11 }, "ua_disagreement": true } }, { "hash": "t13d1011h2_18ef40b21276_6204cfc135c8", "kind": "ja4", "tier": "observed", "classification": "api_client", "description": "curl \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1011h2", "b": "18ef40b21276", "c": "6204cfc135c8", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 10, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49196-49200-52393-52392-49195-49199-49191,0-23-65281-10-11-35-16-13-51-45-43,29-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 61, "first_seen": 1787537067, "last_seen": 1791131613, "transport": "t", "ja3_hash": "705a350d22d8835722a0a4ed7ff0d573", "ja3_variant_count": 1, "ja3_variants": [ "705a350d22d8835722a0a4ed7ff0d573" ], "user_agents": { "curl/8.7.1": 932 }, "ua_disagreement": false } }, { "hash": "t13d1011h2_61a7ad8aa9b6_861bc38b0be4", "kind": "ja4", "tier": "observed", "classification": "api_client", "description": "ClaudeBot \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1011h2", "b": "61a7ad8aa9b6", "c": "861bc38b0be4", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 10, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4866-4865-4867-49196-49195-52393-49200-49199-52392-255,43-11-10-13-23-5-0-51-45-16-35,29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 35, "name": "session_ticket", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 17299, "first_seen": 1787458575, "last_seen": 1791577514, "transport": "t", "ja3_hash": "41b2ed70c1a5d19f22d74bb1859bc7e5", "ja3_variant_count": 14601, "ja3_variants": [ "41b2ed70c1a5d19f22d74bb1859bc7e5", "7d906f69c5bc2c9770408e7bb3bf32e2", "665006e81ca97edd67cfe82aa8ef064a", "ccbdba4668146bc77186c3d867c79ef0", "b3702d33d4709e13cc4ede4382d572ec", "28524fb3a33e4145959f3fb5d8bd2bcb", "026585edd3388244ce3bedf72d81a096", "f0a82f01fc517e2b9b8a812850fe651e", "0cebe51787df0aace4000dc2be5f278f", "6ce46251f230ded04820ecbda1f16b08", "4ed37bf14db63b73e10cf737dd735ad8", "d43c77613feb6bf5bb76ed22440ed7af" ], "user_agents": { "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; Reflectionbot/1.0; +https://reflection.ai/bot) Chrome/151.0.0.0 Safari/537.36": 6930, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36; compatible; OAI-SearchBot/1.4; +https://openai.com/searchbot": 1503, "crusader-worker/1.0": 90, "Mozilla/5.0 (compatible; Reflectionbot/1.0; +https://reflection.ai/bot)": 67, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 (compatible; AionBot/1.0)": 584, "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ClaudeBot/1.0; +claudebot@anthropic.com)": 11214, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36; compatible; OAI-SearchBot/1.4; robots.txt; +https://openai.co": 619, "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; GPTBot/1.4; +https://openai.com/gptbot)": 1092, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0 Safari/537.36": 357, "PQCrypta-Discovery-Agent/1.0.45": 411, "Mozilla/5.0 (compatible; jscrawler/0.1; +https://github.com/)": 56, "PQCrypta-Discovery-Agent/1.0.38": 363, "Mozilla/5.0 (compatible; ExaSearchBot/1.0; +https://crawler.exa.ai/)": 46, "Mozilla/5.0 (Linux; Android 12; TECNO CK6n) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.6422.50 Mobile Safari/537.36": 3, "Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.90 Safari/537.36": 2, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:121.0) Gecko/20100101 Firefox/121.0": 34, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36": 18, "Mozilla/5.0 (X11; Linux x86_64; rv:121.0) Gecko/20100101 Firefox/121.0": 33, "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; SEOJuice-SearchBot/1.0; +https://seojuice.io/bot": 28, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36": 16, "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0": 13, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.2 Safari/605.1.15": 26, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Edg/120.0.0.0": 25, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36": 19, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Mobile Safari/537.36 [ip:93.41.125.186]": 16, "Mozilla/5.0 (compatible; Discordbot/2.0; +https://discordapp.com)": 7, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36": 13, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36": 14, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (Windows NT 11.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6540.18 Safari/537.36": 2, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.6478.70 Safari/537.36 Vivaldi/6.7.3200.25": 1, "Mozilla/5.0 (Linux; Android 14; Pixel 8) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.6422.113 Mobile Safari/537.36": 3, "Mozilla/5.0 (Linux; Android 6.0; Nexus 5 Build/MRA58N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Mobile Safari/537.36": 30, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36": 8, "Mozilla/5.0 (compatible; MatchboxBot/1.0; +https://askmatchbox.com/about-the-crawler) (variant; SupabaseEdgeRuntime/1.77.0; ref=hnqciyxvnaupbukeggwk)": 4, "Mozilla/5.0 (compatible; GitFinder/1.0)": 6, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36": 2, "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_5) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.4 Safari/605.1.15": 1, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36": 2, "Mozilla/5.0 (Windows NT 10.0; Win64; x64; Xbox; Xbox One) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Edge/44.18363.8131": 1, "Mozilla/5.0 (Linux; Android 13; Infinix X688B) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.6367.48 Mobile Safari/537.36": 3, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Edg/129.0.2792.65": 1, "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:130.0) Gecko/20100101 Firefox/130.0": 1, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Mobile Safari/537.36": 1, "Mozilla/5.0 (X11; Fedora; Linux x86_64; rv:125.0) Gecko/20100101 Firefox/125.0": 1, "Mozilla/5.0 (Windows NT 11.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Edg/128.0.2790.25 Chrome/128.0.6540.22 Safari/537.36": 1, "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)": 1 }, "ua_disagreement": true } }, { "hash": "t13d1011ht_61a7ad8aa9b6_861bc38b0be4", "kind": "ja4", "tier": "observed", "classification": "api_client", "description": "ClaudeBot \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1011ht", "b": "61a7ad8aa9b6", "c": "861bc38b0be4", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 10, "extension_count": 11, "alpn": "ht" } }, "ja3_string": "771,4866-4865-4867-49196-49195-52393-49200-49199-52392-255,51-23-5-35-0-43-13-16-11-45-10,29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 10, "name": "supported_groups", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 22, "first_seen": 1787465153, "last_seen": 1791345569, "transport": "t", "ja3_hash": "2b691e81dc805047c32f05e9056d7d0e", "ja3_variant_count": 10, "ja3_variants": [ "2b691e81dc805047c32f05e9056d7d0e", "05594529409294cc37b4e0d762808ab5", "aaa9e92287e1ec7e426e19ebd8f8c6e3", "a266deab455539358459dd30ac11b615", "93d590668db5cca2c5577a601a9d933e", "b34b849644376d0399d995432b56d2b5", "df2e48b15372e89d3c84655a0938301e", "246475982a962f3f045d8975f0075023", "1e6b85619b3c224e3860e05e4ec6e27f", "2eed5d5f8f0e3360934281775bff21fe" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36": 4, "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; Reflectionbot/1.0; +https://reflection.ai/bot) Chrome/151.0.0.0 Safari/537.36": 4, "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; SEOJuice-SearchBot/1.0; +https://seojuice.io/bot": 8, "crusader-worker/1.0": 1, "Mozilla/5.0 (compatible; ExaSearchBot/1.0; +https://crawler.exa.ai/)": 3, "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ClaudeBot/1.0; +claudebot@anthropic.com)": 8, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36; compatible; OAI-SearchBot/1.4; +https://openai.com/searchbot": 1 }, "ua_disagreement": true } }, { "hash": "t13d1113h2_5e2a75874763_0b2c8cf08c1b", "kind": "ja4", "tier": "observed", "classification": "api_client", "description": "CCBot (Common Crawl) \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1113h2", "b": "5e2a75874763", "c": "0b2c8cf08c1b", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 11, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172,0-5-10-11-13-50-16-17-23-43-45-51-65281,29-23-24-25-30-256-257-258-259-260,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 50, "name": "signature_algorithms_cert", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 17, "name": "status_request_v2", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true }, { "value": 258, "name": "ffdhe4096", "known": true }, { "value": 259, "name": "259 (0x0103)", "known": false }, { "value": 260, "name": "260 (0x0104)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 31, "first_seen": 1788342647, "last_seen": 1791574679, "transport": "t", "ja3_hash": "4f0bda65793e2d63b24d640f10d7a51c", "ja3_variant_count": 1, "ja3_variants": [ "4f0bda65793e2d63b24d640f10d7a51c" ], "user_agents": { "ClueWeb-Crawler/1.0 (+https://boston.lti.cs.cmu.edu/CMU-ClueWeb-Crawler/; mailto:cmu-clueweb-crawler@andrew.cmu.edu)": 7, "CCBot/2.0 (https://commoncrawl.org/faq/)": 170 }, "ua_disagreement": false } }, { "hash": "t13d1114h2_5e2a75874763_352e3a9193bf", "kind": "ja4", "tier": "observed", "classification": "api_client", "description": "CCBot (Common Crawl) \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1114h2", "b": "5e2a75874763", "c": "352e3a9193bf", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 11, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172,0-5-10-11-13-50-16-17-23-43-45-51-65281-41,29-23-24-25-30-256-257-258-259-260,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 50, "name": "signature_algorithms_cert", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 17, "name": "status_request_v2", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 41, "name": "pre_shared_key", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true }, { "value": 258, "name": "ffdhe4096", "known": true }, { "value": 259, "name": "259 (0x0103)", "known": false }, { "value": 260, "name": "260 (0x0104)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 49, "first_seen": 1788410960, "last_seen": 1791576189, "transport": "t", "ja3_hash": "0a84269fcc8452ac11db9e0d0b6728db", "ja3_variant_count": 1, "ja3_variants": [ "0a84269fcc8452ac11db9e0d0b6728db" ], "user_agents": { "ClueWeb-Crawler/1.0 (+https://boston.lti.cs.cmu.edu/CMU-ClueWeb-Crawler/; mailto:cmu-clueweb-crawler@andrew.cmu.edu)": 5, "CCBot/2.0 (https://commoncrawl.org/faq/)": 305 }, "ua_disagreement": false } }, { "hash": "t13d121000_0ed44715e6cd_badae892920c", "kind": "ja4", "tier": "observed", "classification": "api_client", "description": "C\u1ed1c C\u1ed1c bot \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d121000", "b": "0ed44715e6cd", "c": "badae892920c", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 12, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49196-49195-49199-49200-49171-49172-156-47-53,0-23-65281-10-11-35-13-51-45-43,29-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 152, "first_seen": 1787446533, "last_seen": 1791497842, "transport": "t", "ja3_hash": "ab1caf6ada0c339e22931167c1fd0e05", "ja3_variant_count": 2, "ja3_variants": [ "ab1caf6ada0c339e22931167c1fd0e05", "e5d57694631abb5452ce9ae9bd3b6d3d" ], "user_agents": { "Mozilla/5.0 (compatible; coccocbot-web/1.0; +http://help.coccoc.com/searchengine)": 62, "LinkedInBot/1.0 (compatible; Mozilla/5.0; Apache-HttpClient +http://www.linkedin.com)": 32, "Mozilla/5.0 (compatible; coccocbot-image/1.0; +http://help.coccoc.com/searchengine)": 53 }, "ua_disagreement": false } }, { "hash": "t13d121100_0ed44715e6cd_996dcf38c216", "kind": "ja4", "tier": "observed", "classification": "api_client", "description": "LinkedInBot \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d121100", "b": "0ed44715e6cd", "c": "996dcf38c216", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 12, "extension_count": 11, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49196-49195-49199-49200-49171-49172-156-47-53,0-23-65281-10-11-35-13-51-45-43-41,29-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 41, "name": "pre_shared_key", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 2, "first_seen": 1789742574, "last_seen": 1791062034, "transport": "t", "ja3_hash": "a0b9fbc7a85132d822cc23c44d648452", "ja3_variant_count": 1, "ja3_variants": [ "a0b9fbc7a85132d822cc23c44d648452" ], "user_agents": { "LinkedInBot/1.0 (compatible; Mozilla/5.0; Apache-HttpClient +http://www.linkedin.com)": 1, "Mozilla/5.0 (compatible; coccocbot-image/1.0; +http://help.coccoc.com/searchengine)": 1 }, "ua_disagreement": false } }, { "hash": "t13d1311h2_f57a46bbacb6_2f5041364463", "kind": "ja4", "tier": "observed", "classification": "api_client", "description": "Go net/http \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1311h2", "b": "f57a46bbacb6", "c": "2f5041364463", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 13, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-4865-4866-4867,0-11-65281-23-18-5-10-13-16-43-51,4588-29-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 68, "first_seen": 1787475042, "last_seen": 1791571519, "transport": "t", "ja3_hash": "ceb419f4203d3159e7a7cb3aa7efd5bd", "ja3_variant_count": 2, "ja3_variants": [ "ceb419f4203d3159e7a7cb3aa7efd5bd", "50982bb7732015b00f10d5024747686f" ], "user_agents": { "Go-http-client/2.0": 42, "Mozilla/5.0": 63, "Mozilla/5.0 (X11; Linux x86_64) Gecko/20100101 Firefox/117.0": 5, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36": 2, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36": 14, "Mozilla/5.0 (compatible; SparixEmailScraper/1.0; +https://sparix.ai)": 16 }, "ua_disagreement": true } }, { "hash": "t13d1312h2_f57a46bbacb6_36b6e4cc52f5", "kind": "ja4", "tier": "observed", "classification": "api_client", "description": "Go net/http \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1312h2", "b": "f57a46bbacb6", "c": "36b6e4cc52f5", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 13, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-4865-4866-4867,0-11-65281-23-18-5-10-13-50-16-43-51,4588-4587-4589-29-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 50, "name": "signature_algorithms_cert", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 4587, "name": "X25519MLKEM768", "known": true }, { "value": 4589, "name": "4589 (0x11ed)", "known": false }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 2790, "first_seen": 1787451385, "last_seen": 1791576583, "transport": "t", "ja3_hash": "03117a8ed39ef02427ebbc39f121275c", "ja3_variant_count": 4, "ja3_variants": [ "03117a8ed39ef02427ebbc39f121275c", "e69402f870ecf542b4f017b0ed32936a", "b87b027808ec9cc24d4714e78a728853", "7d095856c1a82e1d950c2f850b01738c" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36": 3, "Mozilla/5.0 (Macintosh; Intel Mac OS X 13_6_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:154.0) Gecko/20100101 Firefox/154.0": 43, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.1 Safari/605.1.15": 1, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.216 Safari/537.36": 8, "Go-http-client/2.0": 470, "Mozilla/5.0 (iPhone; CPU iPhone OS 17_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.1 Mobile/15E148 Safari/604.1": 4, "Slack-ImgProxy (+https://api.slack.com/robots)": 512, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 Edg/124.0.0.0": 11, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 355 }, "ua_disagreement": true } }, { "hash": "t13d150800_8daaf6152771_0eb8ed479027", "kind": "ja4", "tier": "observed", "classification": "api_client", "description": "Sogou spider \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d150800", "b": "8daaf6152771", "c": "0eb8ed479027", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-13-0-23-65281-10-5-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 2, "first_seen": 1789971691, "last_seen": 1790591314, "transport": "t", "ja3_hash": "d8cf47ef65f8cc58dbd57090e396945d", "ja3_variant_count": 2, "ja3_variants": [ "d8cf47ef65f8cc58dbd57090e396945d", "1ce0dc86f18ea1b916a236b674dd50ad" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36": 2, "Sogou web spider/4.0(+http://www.sogou.com/docs/help/webmasters.htm#07)": 11 }, "ua_disagreement": true } }, { "hash": "t13d1508h2_8daaf6152771_89f5817ff61e", "kind": "ja4", "tier": "observed", "classification": "api_client", "description": "ClaudeBot \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1508h2", "b": "8daaf6152771", "c": "89f5817ff61e", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-43-0-16-18-27-11-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790261940, "last_seen": 1790261940, "transport": "t", "ja3_hash": "e70da9ec2f88e8eb3e3d53f29263d420", "ja3_variant_count": 1, "ja3_variants": [ "e70da9ec2f88e8eb3e3d53f29263d420" ], "user_agents": { "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; Claude-User/1.0; +claudebot@anthropic.com)": 1 }, "ua_disagreement": false } }, { "hash": "t13d1510h2_8daaf6152771_049d0d80589f", "kind": "ja4", "tier": "observed", "classification": "api_client", "description": "Sogou spider \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1510h2", "b": "8daaf6152771", "c": "049d0d80589f", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-65281-16-0-5-65037-45-17613-43-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791047665, "last_seen": 1791047665, "transport": "t", "ja3_hash": "5e48e879becff1ed980dd51c2e073946", "ja3_variant_count": 1, "ja3_variants": [ "5e48e879becff1ed980dd51c2e073946" ], "user_agents": { "Sogou web spider/4.0(+http://www.sogou.com/docs/help/webmasters.htm#07)": 12 }, "ua_disagreement": false } }, { "hash": "t13d1510h2_8daaf6152771_3e1e5eacdaa9", "kind": "ja4", "tier": "observed", "classification": "api_client", "description": "Sogou spider \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1510h2", "b": "8daaf6152771", "c": "3e1e5eacdaa9", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-43-16-23-5-45-18-10-0-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789943175, "last_seen": 1789943175, "transport": "t", "ja3_hash": "278e7ee6c0d40ca8a402240fbcdc91f7", "ja3_variant_count": 1, "ja3_variants": [ "278e7ee6c0d40ca8a402240fbcdc91f7" ], "user_agents": { "Sogou web spider/4.0(+http://www.sogou.com/docs/help/webmasters.htm#07)": 11 }, "ua_disagreement": false } }, { "hash": "t13d1510h2_8daaf6152771_a7f1d7275918", "kind": "ja4", "tier": "observed", "classification": "api_client", "description": "Sogou spider \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1510h2", "b": "8daaf6152771", "c": "a7f1d7275918", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-10-17613-16-65037-5-43-23-0-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790693462, "last_seen": 1790693462, "transport": "t", "ja3_hash": "4daf08852984264796019dbf03840804", "ja3_variant_count": 1, "ja3_variants": [ "4daf08852984264796019dbf03840804" ], "user_agents": { "Sogou web spider/4.0(+http://www.sogou.com/docs/help/webmasters.htm#07)": 11 }, "ua_disagreement": false } }, { "hash": "t13d1510h2_8daaf6152771_e47e1425a0a4", "kind": "ja4", "tier": "observed", "classification": "api_client", "description": "Sogou spider \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1510h2", "b": "8daaf6152771", "c": "e47e1425a0a4", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-0-23-13-11-17613-65281-27-43-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790693459, "last_seen": 1790693459, "transport": "t", "ja3_hash": "21e473664409c29064e01f1b7eb8e4ad", "ja3_variant_count": 1, "ja3_variants": [ "21e473664409c29064e01f1b7eb8e4ad" ], "user_agents": { "Sogou web spider/4.0(+http://www.sogou.com/docs/help/webmasters.htm#07)": 1 }, "ua_disagreement": false } }, { "hash": "t13d151100_1b8cdd526c76_bdb8e2a68208", "kind": "ja4", "tier": "observed", "classification": "api_client", "description": "Go net/http \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d151100", "b": "1b8cdd526c76", "c": "bdb8e2a68208", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": null } }, "ja3_string": "771,4867-4865-4866-156-52393-60-49196-49195-49200-49199-49191-47-49161-53-10,51-65281-23-35-5-13-0-10-43-45-11,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788858272, "last_seen": 1788858272, "transport": "t", "ja3_hash": "fb6d895b41182c7bf490c9fabfbdd8b2", "ja3_variant_count": 1, "ja3_variants": [ "fb6d895b41182c7bf490c9fabfbdd8b2" ], "user_agents": { "Go-http-client/1.1": 1 }, "ua_disagreement": false } }, { "hash": "t13d1513h2_8daaf6152771_a1c857e0187c", "kind": "ja4", "tier": "observed", "classification": "api_client", "description": "DuckDuckGo app \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1513h2", "b": "8daaf6152771", "c": "a1c857e0187c", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49196-52393-49199-49200-52392-49171-49172-156-157-47-53,0-23-65281-10-11-35-16-5-13-51-45-43-41,29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 41, "name": "pre_shared_key", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790651503, "last_seen": 1790651503, "transport": "t", "ja3_hash": "d75e7289c86c15b305ac36097bfa0487", "ja3_variant_count": 1, "ja3_variants": [ "d75e7289c86c15b305ac36097bfa0487" ], "user_agents": { "DuckDuckGo/5 (com.duckduckgo.mobile.android; Android API 37)": 2 }, "ua_disagreement": false } }, { "hash": "t13d1513h2_8daaf6152771_aea78d538e14", "kind": "ja4", "tier": "observed", "classification": "api_client", "description": "DuckDuckGo app \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1513h2", "b": "8daaf6152771", "c": "aea78d538e14", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 15, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-23-65281-10-11-35-16-5-13-51-45-43-21,29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 21, "name": "padding", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 40, "first_seen": 1787494411, "last_seen": 1791236479, "transport": "t", "ja3_hash": "1d714db2228763eab228fc28ce7f8e4f", "ja3_variant_count": 2, "ja3_variants": [ "1d714db2228763eab228fc28ce7f8e4f", "f79b6bad2ad0641e1921aef10262856b" ], "user_agents": { "DuckDuckGo/5 (com.duckduckgo.mobile.android; Android API 36)": 14, "DuckDuckGo/5 (com.duckduckgo.mobile.android; Android API 37)": 15, "Mozilla/5.0 (Linux; Android 8.0.0; SM-J330G) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Mobile Safari/537.36 EdgA/114.0.1823.74": 2, "GoogleMessages/20.2 facebookexternalhit/1.1 Facebot Twitterbot/1.0": 2, "slack/26.08.40.0.90016107 (samsung SM-S911B; Android 16; store com.android.vending)": 3, "slack/26.08.40.0.90016107 (samsung SM-S901B; Android 16; store com.android.vending)": 3 }, "ua_disagreement": true } }, { "hash": "t13d160900_693fa8a1e7ee_53d4e768415e", "kind": "ja4", "tier": "observed", "classification": "api_client", "description": "Claude-User \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d160900", "b": "693fa8a1e7ee", "c": "53d4e768415e", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 16, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4866-4865-49196-49200-49195-49199-49191-157-156-49162-49172-49161-49171-53-47-255,0-11-10-23-13-43-45-51-21,23-24-29,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 21, "name": "padding", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 29, "name": "x25519", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790696980, "last_seen": 1790696980, "transport": "t", "ja3_hash": "778ab9e2a3b6019122bd2331d5aca8c4", "ja3_variant_count": 1, "ja3_variants": [ "778ab9e2a3b6019122bd2331d5aca8c4" ], "user_agents": { "Claude-User (claude-code/2.1.284; +https://support.anthropic.com/)": 1 }, "ua_disagreement": false } }, { "hash": "t13d160900_6d57ae910dcb_73b007f92d04", "kind": "ja4", "tier": "observed", "classification": "api_client", "description": "Go net/http \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d160900", "b": "6d57ae910dcb", "c": "73b007f92d04", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 16, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4867-4866-60-49196-49200-156-49195-52393-52392-49187-10-47-49170-49161-49172,45-65281-5-0-18-35-10-43-51,4588-29-23-24-25,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789304605, "last_seen": 1789304605, "transport": "t", "ja3_hash": "373d937c28ac363f0b372884eea7bff9", "ja3_variant_count": 1, "ja3_variants": [ "373d937c28ac363f0b372884eea7bff9" ], "user_agents": { "Go-http-client/1.1": 1 }, "ua_disagreement": false } }, { "hash": "t13d1611h2_e3d26ca8fde7_7b6bd56f487f", "kind": "ja4", "tier": "observed", "classification": "api_client", "description": "Go net/http \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1611h2", "b": "e3d26ca8fde7", "c": "7b6bd56f487f", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 16, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4866-4867-156-49200-52392-49187-52393-49191-157-49196-49199-10-53-49170-49172-47,16-11-43-0-35-13-45-65281-10-5-51,4588-29-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791145390, "last_seen": 1791145390, "transport": "t", "ja3_hash": "4d6a39c7a577a33a6fa1d20cf45e3949", "ja3_variant_count": 1, "ja3_variants": [ "4d6a39c7a577a33a6fa1d20cf45e3949" ], "user_agents": { "Go-http-client/2.0": 1 }, "ua_disagreement": false } }, { "hash": "t13d1616h2_46e7e9700bed_f6824c026247", "kind": "ja4", "tier": "observed", "classification": "api_client", "description": "Go net/http \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1616h2", "b": "46e7e9700bed", "c": "f6824c026247", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 16, "extension_count": 16, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53-10,65281-0-23-35-13-5-18-16-30032-11-51-45-43-10-27-21,29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 30032, "name": "30032 (0x7550)", "known": false }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 21, "name": "padding", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 18, "first_seen": 1787497300, "last_seen": 1791577222, "transport": "t", "ja3_hash": "6a958df291c3f2ee216e80434750d4e1", "ja3_variant_count": 1, "ja3_variants": [ "6a958df291c3f2ee216e80434750d4e1" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36 OPR/89.0.4447.98": 1, "Go-http-client/2.0": 2 }, "ua_disagreement": true } }, { "hash": "t13d171000_5b57614c22b0_badae892920c", "kind": "ja4", "tier": "observed", "classification": "api_client", "description": "Claude-User \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d171000", "b": "5b57614c22b0", "c": "badae892920c", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 17, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-156-157-47-53,0-23-65281-10-11-35-13-51-45-43,29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 11, "first_seen": 1789075002, "last_seen": 1790119845, "transport": "t", "ja3_hash": "203503b7023848ab87b9836c336b8e81", "ja3_variant_count": 1, "ja3_variants": [ "203503b7023848ab87b9836c336b8e81" ], "user_agents": { "Dart/3.11 (dart:io)": 13, "Claude-User (claude-code/2.1.228; +https://support.anthropic.com/)": 2, "Claude-User (claude-code/2.1.196; +https://support.anthropic.com/)": 1 }, "ua_disagreement": false } }, { "hash": "t13d1713ht_ab0a1bf427ad_23c7dd8c4d5c", "kind": "ja4", "tier": "observed", "classification": "api_client", "description": "Python requests \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1713ht", "b": "ab0a1bf427ad", "c": "23c7dd8c4d5c", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 17, "extension_count": 13, "alpn": "ht" } }, "ja3_string": "771,4866-4867-4865-49196-49200-49195-49199-52393-52392-49188-49192-49187-49191-159-158-107-103,65281-0-11-10-16-22-23-49-13-43-45-51-27,4588-29-23-30-24-25-256-257,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 49, "name": "post_handshake_auth", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 27, "name": "compress_certificate", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 134, "first_seen": 1787444792, "last_seen": 1791542164, "transport": "t", "ja3_hash": "86dab2109182b6bbaa644647d7db2997", "ja3_variant_count": 1, "ja3_variants": [ "86dab2109182b6bbaa644647d7db2997" ], "user_agents": { "Mozilla/5.0 (compatible; url-crawler/1.0)": 7, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0 Safari/537.36 NWSIP-Stage1": 17, "python-requests/2.33.1": 52 }, "ua_disagreement": true } }, { "hash": "t13d181000_0b3ac25db417_282979f8dc72", "kind": "ja4", "tier": "observed", "classification": "api_client", "description": "Go net/http \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d181000", "b": "0b3ac25db417", "c": "282979f8dc72", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 18, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4866-4867-4865-49200-49196-49195-52392-49187-49199-49191-52393-157-156-49171-49170-47-49161-53,51-43-35-45-0-11-5-10-65281-13,4588-29-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789721634, "last_seen": 1789721634, "transport": "t", "ja3_hash": "49185a94c0c857c72b0738a235d97ca4", "ja3_variant_count": 1, "ja3_variants": [ "49185a94c0c857c72b0738a235d97ca4" ], "user_agents": { "Go-http-client/1.1": 1 }, "ua_disagreement": false } }, { "hash": "t13d181000_5d04281c6031_badae892920c", "kind": "ja4", "tier": "observed", "classification": "api_client", "description": "Claude-User \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d181000", "b": "5d04281c6031", "c": "badae892920c", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 18, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49199-49195-49200-49196-49191-52393-52392-49161-49171-49162-49172-156-157-47-53,0-23-65281-10-11-35-13-51-45-43,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 20, "first_seen": 1788536349, "last_seen": 1791494051, "transport": "t", "ja3_hash": "5355e3851d76d069ab8a98fdb51cf1b4", "ja3_variant_count": 2, "ja3_variants": [ "5355e3851d76d069ab8a98fdb51cf1b4", "71dc8c533dd919ae9f4963224a4ba8fd" ], "user_agents": { "GrokBot-LinkPreview/1.0": 1, "Claude-User (claude-code/2.1.260; +https://support.anthropic.com/)": 5, "Claude-User (claude-code/2.1.266; +https://support.anthropic.com/)": 2, "WhatsApp/2": 6 }, "ua_disagreement": false } }, { "hash": "t13d181100_5d04281c6031_996dcf38c216", "kind": "ja4", "tier": "observed", "classification": "api_client", "description": "Claude-User \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d181100", "b": "5d04281c6031", "c": "996dcf38c216", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 18, "extension_count": 11, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49199-49195-49200-49196-49191-52393-52392-49161-49171-49162-49172-156-157-47-53,0-23-65281-10-11-35-13-51-45-43-41,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 41, "name": "pre_shared_key", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 4, "first_seen": 1790179600, "last_seen": 1791139872, "transport": "t", "ja3_hash": "f692ab6e3ffc6d9558b71841ac52ee67", "ja3_variant_count": 2, "ja3_variants": [ "f692ab6e3ffc6d9558b71841ac52ee67", "d76a5a80b4bb0c75ac45782b0b53da91" ], "user_agents": { "Claude-User (claude-code/2.1.280; +https://support.anthropic.com/)": 2, "GrokBot-LinkPreview/1.0": 2 }, "ua_disagreement": false } }, { "hash": "t13d181300_e8a523a41297_184ca06a0196", "kind": "ja4", "tier": "observed", "classification": "api_client", "description": "Googlebot \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d181300", "b": "e8a523a41297", "c": "184ca06a0196", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 18, "extension_count": 13, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-52393-52392-49196-49200-49161-49171-49162-49172-156-157-47-53-10,0-23-65281-10-11-35-5-13-18-51-45-43-21,29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 21, "name": "padding", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 19729, "first_seen": 1787442668, "last_seen": 1791577377, "transport": "t", "ja3_hash": "b4da7f95e46bf2cf5285fd609cf726e4", "ja3_variant_count": 1, "ja3_variants": [ "b4da7f95e46bf2cf5285fd609cf726e4" ], "user_agents": { "Mozilla/5.0 (Linux; Android 6.0.1; Nexus 5X Build/MMB29P) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.7922.137 Mobile Safari/537.36 (compatible; GoogleOther)": 145, "Mozilla/5.0 (Linux; Android 6.0.1; Nexus 5X Build/MMB29P) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.7922.137 Mobile Safari/537.36 (compatible; Googlebot/2.1; +http://www.": 541, "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)": 4700 }, "ua_disagreement": true } }, { "hash": "t13d1815h2_e8a523a41297_2b6791c0b3dd", "kind": "ja4", "tier": "observed", "classification": "api_client", "description": "Go net/http \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1815h2", "b": "e8a523a41297", "c": "2b6791c0b3dd", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 18, "extension_count": 15, "alpn": "h2" } }, "ja3_string": "771,4865-4867-4866-49195-49199-52393-52392-49196-49200-49162-49161-49171-49172-156-157-47-53-10,0-23-65281-10-11-35-16-5-34-51-43-13-45-28-21,29-23-24-25-256-257,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 34, "name": "34 (0x0022)", "known": false }, { "value": 51, "name": "key_share", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 28, "name": "record_size_limit", "known": true }, { "value": 21, "name": "padding", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 17, "first_seen": 1787507636, "last_seen": 1791200237, "transport": "t", "ja3_hash": "6b5e0cfe988c723ee71faf54f8460684", "ja3_variant_count": 1, "ja3_variants": [ "6b5e0cfe988c723ee71faf54f8460684" ], "user_agents": { "Opera/9.80 (Windows NT 5.1; U; en) Presto/2.10.289 Version/12.01": 1, "Go-http-client/2.0": 2 }, "ua_disagreement": false } }, { "hash": "t13d190900_9dc949149365_a38838ecc1fa", "kind": "ja4", "tier": "observed", "classification": "api_client", "description": "Baiduspider \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d190900", "b": "9dc949149365", "c": "a38838ecc1fa", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 19, "extension_count": 9, "alpn": null } }, "ja3_string": "771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-156-157-47-53-49170-10-4865-4866-4867,0-5-10-11-13-65281-18-43-51,29-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1392, "first_seen": 1787445446, "last_seen": 1791573781, "transport": "t", "ja3_hash": "473cd7cb9faa642487833865d516e578", "ja3_variant_count": 14, "ja3_variants": [ "473cd7cb9faa642487833865d516e578", "1f24dbdea9cbd448a034e5d87c14168f", "df669e7ea913f1ac0c0cce9a201a2ec1", "ae2a25e9a0c2e9ecb596d03efbf0201f", "47a36c0c58b105f3f70b6f6bd0eb0df0", "b32a7b2beb4672901621249925410fc4", "75395445c5b459a9809fdda2daeef677", "ac0c792b27ec00af1100e3fefa06d37c", "77345ff2ee9432a9b2d096ffcd8b36b9", "fa4850aa84412d860833b8fc4e25ed4c", "3c2356f00ce5d22d40e9265a27f16a89", "4b2ba11d6191aa6676eb7fc5440e8497" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; WOW64; rv:63.0) Gecko/20100101 Firefox/63.0.3": 1, "Go-http-client/1.1": 6, "Mozilla/5.0 (Windows NT 6.2; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.143 Safari/537.36": 1, "Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Safari/537.36": 16, "Mozilla/5.0 (compatible; Baiduspider-render/2.0; +http://www.baidu.com/search/spider.html)": 550, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36": 13, "Mozilla/5.0 (compatible; CensysInspect/1.1; +https://about.censys.io/)": 172, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36 ModatScanner/1.2 (+https://modat.io/)": 2, "visionheight.com/scan Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome/126.0.0.0 Safari/537.36": 68 }, "ua_disagreement": true } }, { "hash": "t13d1912h2_9dc949149365_649d7e7da4f5", "kind": "ja4", "tier": "observed", "classification": "api_client", "description": "ClaudeBot \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d1912h2", "b": "9dc949149365", "c": "649d7e7da4f5", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 19, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-156-157-47-53-49170-10-4865-4866-4867,0-5-10-11-35-13-65281-16-18-43-51-45,29-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 13, "first_seen": 1790507908, "last_seen": 1790549946, "transport": "t", "ja3_hash": "c51e7c302014a5bc35f63c466c247fb4", "ja3_variant_count": 1, "ja3_variants": [ "c51e7c302014a5bc35f63c466c247fb4" ], "user_agents": { "Mozilla/5.0 (compatible; YouBot/1.0; +https://you.com/bot)": 1, "Mozilla/5.0 (compatible; Bravebot/1.0; +https://brave.com/search/)": 1, "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; Claude-User/1.0; +claudebot@anthropic.com)": 2 }, "ua_disagreement": false } }, { "hash": "t13d2012h2_272d1fb6f253_654875230aab", "kind": "ja4", "tier": "observed", "classification": "api_client", "description": "Go net/http \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d2012h2", "b": "272d1fb6f253", "c": "654875230aab", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 20, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4866-4865-4867-52392-49200-52393-60-157-156-49199-49187-49195-49196-49161-10-49170-49172-49171-47-53,16-45-10-51-43-17513-11-18-35-0-23-13,4588-29-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 17513, "name": "application_settings", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788603928, "last_seen": 1788603928, "transport": "t", "ja3_hash": "13956809fa5c182adaae30aa0dd2b623", "ja3_variant_count": 1, "ja3_variants": [ "13956809fa5c182adaae30aa0dd2b623" ], "user_agents": { "Go-http-client/2.0": 1 }, "ua_disagreement": false } }, { "hash": "t13d2013ht_2b729b4bf6f3_b9165cb4b096", "kind": "ja4", "tier": "observed", "classification": "api_client", "description": "curl \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d2013ht", "b": "2b729b4bf6f3", "c": "b9165cb4b096", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 20, "extension_count": 13, "alpn": "ht" } }, "ja3_string": "771,4866-4865-49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47,0-5-43-13-35-10-11-16-51-49-23-65281-45,29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 49, "name": "post_handshake_auth", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 5, "first_seen": 1788937260, "last_seen": 1790959069, "transport": "t", "ja3_hash": "fae0e5d973c96ae1888b99538efa0363", "ja3_variant_count": 1, "ja3_variants": [ "fae0e5d973c96ae1888b99538efa0363" ], "user_agents": { "curl/8.21.0": 3 }, "ua_disagreement": false } }, { "hash": "t13d250900_b78ed14e2fd0_a38838ecc1fa", "kind": "ja4", "tier": "observed", "classification": "api_client", "description": "Shares its JA4_c (a38838ecc1fa) with 1 fingerprint classified as api_client, and nothing else in that family disagrees \u2014 the same tool under different cipher options. Inferred from the family, not observed directly.", "ja4": { "a": "t13d250900", "b": "b78ed14e2fd0", "c": "a38838ecc1fa", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 25, "extension_count": 9, "alpn": null } }, "ja3_string": "771,10-47-53-156-157-49161-49162-49170-49171-49172-49195-49196-49199-49200-52392-52393-5-60-49159-49169-49187-49191-4867-4865-4866,0-5-10-11-13-65281-18-43-51,29-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 5, "name": "TLS_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49159, "name": "TLS_ECDHE_ECDSA_WITH_RC4_128_SHA", "known": true }, { "value": 49169, "name": "TLS_ECDHE_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 14, "first_seen": 1787969603, "last_seen": 1791474758, "transport": "t", "ja3_hash": "ab9a771514223079d9b13419b45c50c7", "ja3_variant_count": 2, "ja3_variants": [ "ab9a771514223079d9b13419b45c50c7", "92811ece7597da1ebf5018a8faa5082a" ], "user_agents": [], "ua_disagreement": false }, "inferred_from_family": true }, { "hash": "t13d260900_3309cf098094_a38838ecc1fa", "kind": "ja4", "tier": "observed", "classification": "api_client", "description": "Shares its JA4_c (a38838ecc1fa) with 1 fingerprint classified as api_client, and nothing else in that family disagrees \u2014 the same tool under different cipher options. Inferred from the family, not observed directly.", "ja4": { "a": "t13d260900", "b": "3309cf098094", "c": "a38838ecc1fa", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 26, "extension_count": 9, "alpn": null } }, "ja3_string": "771,52392-52393-49199-49200-49195-49196-49161-158-52392-52394-51-61-22-49162-57-49171-10-49172-156-157-47-53-49170-4867-4865-4866,0-5-10-11-13-65281-18-43-51,29-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 22, "name": "TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 43, "first_seen": 1787995878, "last_seen": 1790681464, "transport": "t", "ja3_hash": "43421e3931de5c5355809e68ec542a8d", "ja3_variant_count": 1, "ja3_variants": [ "43421e3931de5c5355809e68ec542a8d" ], "user_agents": [], "ua_disagreement": false }, "inferred_from_family": true }, { "hash": "t13d291300_723694b0fccc_ff9189fa9ce3", "kind": "ja4", "tier": "observed", "classification": "api_client", "description": "wget \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d291300", "b": "723694b0fccc", "c": "ff9189fa9ce3", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 29, "extension_count": 13, "alpn": null } }, "ja3_string": "771,4866-4867-4865-4868-49196-52393-49325-49162-49195-49324-49161-49200-52392-49172-49199-49171-157-49309-53-156-49308-47-159-52394-49311-57-158-49310-51,65281-13-0-43-11-35-5-49-28-51-45-10-21,23-24-25-29-30-256-257-258-259-260,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4868, "name": "TLS_AES_128_CCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49325, "name": "TLS_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49324, "name": "TLS_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49309, "name": "TLS_DHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49308, "name": "TLS_DHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49311, "name": "TLS_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49310, "name": "TLS_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 49, "name": "post_handshake_auth", "known": true }, { "value": 28, "name": "record_size_limit", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 21, "name": "padding", "known": true } ], "curves": [ { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true }, { "value": 258, "name": "ffdhe4096", "known": true }, { "value": 259, "name": "259 (0x0103)", "known": false }, { "value": 260, "name": "260 (0x0104)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789496446, "last_seen": 1789496446, "transport": "t", "ja3_hash": "9722ed5304debc3067288b8876635ae1", "ja3_variant_count": 1, "ja3_variants": [ "9722ed5304debc3067288b8876635ae1" ], "user_agents": { "Wget/1.25.0": 1 }, "ua_disagreement": false } }, { "hash": "t13d3013h2_1d37bd780c83_23c7dd8c4d5c", "kind": "ja4", "tier": "observed", "classification": "api_client", "description": "PQCrypta IP heartbeat \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d3013h2", "b": "1d37bd780c83", "c": "23c7dd8c4d5c", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 30, "extension_count": 13, "alpn": "h2" } }, "ja3_string": "771,4866-4867-4865-49196-49200-159-52393-52392-52394-49195-49199-158-49188-49192-107-49187-49191-103-49162-49172-57-49161-49171-51-157-156-61-60-53-47,65281-0-11-10-16-22-23-49-13-43-45-51-27,4588-29-23-30-24-25-256-257,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 49, "name": "post_handshake_auth", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 27, "name": "compress_certificate", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 30520, "first_seen": 1787442792, "last_seen": 1791577439, "transport": "t", "ja3_hash": "32e4b8812cda0c0d50783b438492a769", "ja3_variant_count": 2, "ja3_variants": [ "32e4b8812cda0c0d50783b438492a769", "7a73fb0bdeaa2a79fadf356c34e7577e" ], "user_agents": { "Mozilla/5.0 (X11; Linux x86_64; rv:115.0) Gecko/20100101 Firefox/115.0": 2, "pqcrypta-ip-update/1.0 (us-midwest heartbeat)": 12071, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36": 647, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36": 2, "Mozilla/5.0": 1 }, "ua_disagreement": true } }, { "hash": "t13d3013ht_1d37bd780c83_99c94103f5e0", "kind": "ja4", "tier": "observed", "classification": "api_client", "description": "Python aiohttp \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d3013ht", "b": "1d37bd780c83", "c": "99c94103f5e0", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 30, "extension_count": 13, "alpn": "ht" } }, "ja3_string": "771,4866-4867-4865-49196-49200-159-52393-52392-52394-49195-49199-158-49188-49192-107-49187-49191-103-49162-49172-57-49161-49171-51-157-156-61-60-53-47,65281-0-11-10-35-16-22-23-13-43-45-51-27,4588-29-23-30-24-25-256-257,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 27, "name": "compress_certificate", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 10629, "first_seen": 1787442800, "last_seen": 1791576424, "transport": "t", "ja3_hash": "8ecf4858a704c8936042f20a8bedee04", "ja3_variant_count": 1, "ja3_variants": [ "8ecf4858a704c8936042f20a8bedee04" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36": 2, "Python/3.14 aiohttp/3.14.1": 10, "Mozilla/5.0 (compatible; GlobRadarBot/1.0; +https://globradar.com/bot)": 51 }, "ua_disagreement": true } }, { "hash": "t13d3014ht_1d37bd780c83_ed8524ea7a97", "kind": "ja4", "tier": "observed", "classification": "api_client", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d3014ht", "b": "1d37bd780c83", "c": "ed8524ea7a97", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 30, "extension_count": 14, "alpn": "ht" } }, "ja3_string": "771,4866-4867-4865-49196-49200-159-52393-52392-52394-49195-49199-158-49188-49192-107-49187-49191-103-49162-49172-57-49161-49171-51-157-156-61-60-53-47,65281-0-11-10-35-16-22-23-49-13-43-45-51-27,4588-29-23-30-24-25-256-257,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 49, "name": "post_handshake_auth", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 27, "name": "compress_certificate", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 5829, "first_seen": 1788093982, "last_seen": 1791416407, "transport": "t", "ja3_hash": "88f1fd7a4ad8bf2abd56176f5455424b", "ja3_variant_count": 1, "ja3_variants": [ "88f1fd7a4ad8bf2abd56176f5455424b" ], "user_agents": { "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36": 4, "Mozilla/5.0 (compatible; SiteScan/1.0; read-mostly QA gate; respects robots)": 4, "Python-urllib/3.14": 2 }, "ua_disagreement": false } }, { "hash": "t13d311000_e8f1e7e78f70_436cb0bc5860", "kind": "ja4", "tier": "observed", "classification": "api_client", "description": "OkHttp \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d311000", "b": "e8f1e7e78f70", "c": "436cb0bc5860", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 31, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4866-4867-4865-49196-49200-159-52393-52392-52394-49195-49199-158-49188-49192-107-49187-49191-103-49162-49172-57-49161-49171-51-157-156-61-60-53-47-255,0-11-10-22-23-13-43-45-51-21,29-23-30-25-24-256-257-258-259-260,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 21, "name": "padding", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true }, { "value": 258, "name": "ffdhe4096", "known": true }, { "value": 259, "name": "259 (0x0103)", "known": false }, { "value": 260, "name": "260 (0x0104)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 70, "first_seen": 1787463140, "last_seen": 1791232384, "transport": "t", "ja3_hash": "5cc600468c246704e1699c12f51eb3ab", "ja3_variant_count": 1, "ja3_variants": [ "5cc600468c246704e1699c12f51eb3ab" ], "user_agents": { "okhttp/3.0": 10, "Mozilla/5.0 (Windows; U; Windows NT 5.2) AppleWebKit/535.17.5 (KHTML, like Gecko) Version/4.1 Safari/535.17.5": 1, "Mozilla/5.0 (X11; Linux i686; rv:1.9.7.20) Gecko/5931-08-10 02:36:48.102402 Firefox/3.6.9": 1 }, "ua_disagreement": true } }, { "hash": "t13d311000_e8f1e7e78f70_7ef8eb972a3c", "kind": "ja4", "tier": "observed", "classification": "api_client", "description": "Sogou spider \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d311000", "b": "e8f1e7e78f70", "c": "7ef8eb972a3c", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 31, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4866-4867-4865-49196-49200-159-52393-52392-52394-49195-49199-158-49188-49192-107-49187-49191-103-49162-49172-57-49161-49171-51-157-156-61-60-53-47-255,0-11-10-35-22-23-13-43-45-51,29-23-24-25,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 511, "first_seen": 1787471734, "last_seen": 1791532466, "transport": "t", "ja3_hash": "a267e5aa93a4cd7f93a715ac4491fa0b", "ja3_variant_count": 2, "ja3_variants": [ "a267e5aa93a4cd7f93a715ac4491fa0b", "40adfd923eb82b89d8836ba37a19bca1" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/72.0.3626.109 Safari/537.36": 2, "ALittle Client": 23, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36": 8, "Sogou web spider/4.0(+http://www.sogou.com/docs/help/webmasters.htm#07)": 453, "Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36": 39 }, "ua_disagreement": true } }, { "hash": "t13d3112h2_e8f1e7e78f70_9d3cd320fc9b", "kind": "ja4", "tier": "observed", "classification": "api_client", "description": "Baiduspider \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d3112h2", "b": "e8f1e7e78f70", "c": "9d3cd320fc9b", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 31, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4866-4867-4865-49196-49200-159-52393-52392-52394-49195-49199-158-49188-49192-107-49187-49191-103-49162-49172-57-49161-49171-51-157-156-61-60-53-47-255,0-11-10-16-22-23-49-13-43-45-51-41,29-23-30-25-24-256-257-258-259-260,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 49, "name": "post_handshake_auth", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 41, "name": "pre_shared_key", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true }, { "value": 258, "name": "ffdhe4096", "known": true }, { "value": 259, "name": "259 (0x0103)", "known": false }, { "value": 260, "name": "260 (0x0104)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 41, "first_seen": 1787478196, "last_seen": 1791564868, "transport": "t", "ja3_hash": "976771cc12ab6391a021ebc6c1d77991", "ja3_variant_count": 1, "ja3_variants": [ "976771cc12ab6391a021ebc6c1d77991" ], "user_agents": { "Mozilla/5.0 (compatible; Baiduspider/2.0; +http://www.baidu.com/search/spider.html)": 29, "Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/48.0.2564.116 Safari/537.36": 12 }, "ua_disagreement": true } }, { "hash": "t13d3112ht_1d947a95fc68_68567893068e", "kind": "ja4", "tier": "observed", "classification": "api_client", "description": "SeznamBot \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d3112ht", "b": "1d947a95fc68", "c": "68567893068e", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 31, "extension_count": 12, "alpn": "ht" } }, "ja3_string": "771,4866-4865-4867-49196-49195-52393-49200-52392-49199-159-52394-163-158-162-49188-49192-49187-49191-107-106-103-64-49162-49172-49161-49171-57-56-51-50-255,0-5-10-11-13-50-16-17-23-43-45-51,29-23-24-25-30-256-257-258-259-260,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 163, "name": "163 (0x00a3)", "known": false }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 162, "name": "162 (0x00a2)", "known": false }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 106, "name": "106 (0x006a)", "known": false }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 64, "name": "64 (0x0040)", "known": false }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 56, "name": "56 (0x0038)", "known": false }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 50, "name": "50 (0x0032)", "known": false }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 50, "name": "signature_algorithms_cert", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 17, "name": "status_request_v2", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true }, { "value": 258, "name": "ffdhe4096", "known": true }, { "value": 259, "name": "259 (0x0103)", "known": false }, { "value": 260, "name": "260 (0x0104)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 991, "first_seen": 1787443872, "last_seen": 1791576214, "transport": "t", "ja3_hash": "dc78674c6c856f9f22389e8180ee8350", "ja3_variant_count": 1, "ja3_variants": [ "dc78674c6c856f9f22389e8180ee8350" ], "user_agents": { "Mozilla/5.0 (compatible; SeznamBot/4.0; +https://o-seznam.cz/napoveda/vyhledavani/en/seznambot-crawler/)": 991 }, "ua_disagreement": false } }, { "hash": "t13d3112ht_e8f1e7e78f70_64f78f54e6a2", "kind": "ja4", "tier": "observed", "classification": "api_client", "description": "YandexBot \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d3112ht", "b": "e8f1e7e78f70", "c": "64f78f54e6a2", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 31, "extension_count": 12, "alpn": "ht" } }, "ja3_string": "771,4866-4867-4865-49196-49200-159-52393-52392-52394-49195-49199-158-49188-49192-107-49187-49191-103-49162-49172-57-49161-49171-51-157-156-61-60-53-47-255,0-11-10-16-22-23-49-13-43-45-51-21,29-23-30-25-24,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 49, "name": "post_handshake_auth", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 21, "name": "padding", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 2222, "first_seen": 1787448893, "last_seen": 1791572564, "transport": "t", "ja3_hash": "bc29aa426fc99c0be1b9be941869f88a", "ja3_variant_count": 1, "ja3_variants": [ "bc29aa426fc99c0be1b9be941869f88a" ], "user_agents": { "Mozilla/5.0 (compatible; YandexRenderResourcesBot/1.0; +http://yandex.com/bots) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0": 53, "Mozilla/5.0 (compatible; YandexBot/3.0; +http://yandex.com/bots)": 2097, "Mozilla/5.0 (compatible; YandexBot/3.0; +http://yandex.com/bots) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0": 38 }, "ua_disagreement": true } }, { "hash": "t13d3713h1_5c443a9f7afe_c40af2ed6e85", "kind": "ja4", "tier": "observed", "classification": "api_client", "description": "Python httpx \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d3713h1", "b": "5c443a9f7afe", "c": "c40af2ed6e85", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 37, "extension_count": 13, "alpn": "h1" } }, "ja3_string": "771,4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49325-49324-49188-49192-49187-49191-49162-49172-49161-49171-49311-49310-107-103-57-51-157-156-49309-49308-61-60-53-47-255,0-11-10-35-16-22-23-49-13-43-45-51-21,29-23-30-25-24-256-257-258-259-260,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49325, "name": "TLS_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49324, "name": "TLS_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49311, "name": "TLS_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49310, "name": "TLS_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49309, "name": "TLS_DHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49308, "name": "TLS_DHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 49, "name": "post_handshake_auth", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 21, "name": "padding", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true }, { "value": 258, "name": "ffdhe4096", "known": true }, { "value": 259, "name": "259 (0x0103)", "known": false }, { "value": 260, "name": "260 (0x0104)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791497220, "last_seen": 1791497220, "transport": "t", "ja3_hash": "b9b00611ec8668da2819246018314aa9", "ja3_variant_count": 1, "ja3_variants": [ "b9b00611ec8668da2819246018314aa9" ], "user_agents": { "python-httpx/0.27.2": 1 }, "ua_disagreement": false } }, { "hash": "t13d4907h2_0d8feac7bc37_f58b2dd76f93", "kind": "ja4", "tier": "observed", "classification": "api_client", "description": "curl \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d4907h2", "b": "0d8feac7bc37", "c": "f58b2dd76f93", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 49, "extension_count": 7, "alpn": "h2" } }, "ja3_string": "771,4867-4866-4865-52393-52392-52394-49200-49196-49192-49188-49172-49162-159-107-57-65413-196-136-129-157-61-53-192-132-49199-49195-49191-49187-49171-49161-158-103-51-190-69-156-60-47-186-65-49169-49159-5-4-49170-49160-22-10-255,43-51-0-11-10-13-16,29-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 65413, "name": "65413 (0xff85)", "known": false }, { "value": 196, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA256", "known": true }, { "value": 136, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 129, "name": "129 (0x0081)", "known": false }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 192, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA256", "known": true }, { "value": 132, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 190, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 69, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 186, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 65, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 49169, "name": "TLS_ECDHE_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 49159, "name": "TLS_ECDHE_ECDSA_WITH_RC4_128_SHA", "known": true }, { "value": 5, "name": "TLS_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 4, "name": "TLS_RSA_WITH_RC4_128_MD5", "known": true }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 49160, "name": "TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 22, "name": "TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 78, "first_seen": 1787472768, "last_seen": 1791547942, "transport": "t", "ja3_hash": "375c6162a492dfbf2795909110ce8424", "ja3_variant_count": 1, "ja3_variants": [ "375c6162a492dfbf2795909110ce8424" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36": 2, "curl/8.7.1": 51, "Mozilla/5.0": 10 }, "ua_disagreement": true } }, { "hash": "t13d491200_bd868743f55c_f0d148687978", "kind": "ja4", "tier": "observed", "classification": "api_client", "description": "LinkedInBot \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d491200", "b": "bd868743f55c", "c": "f0d148687978", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 49, "extension_count": 12, "alpn": null } }, "ja3_string": "771,4866-4865-4867-49196-49195-52393-49200-52392-49199-159-52394-163-158-162-49188-49192-49187-49191-107-106-103-64-49198-49202-49197-49201-49190-49194-49189-49193-49162-49172-49161-49171-57-56-51-50-49157-49167-49156-49166-157-156-61-60-53-47-255,0-5-10-11-17-23-35-13-43-45-50-51,29-23-24-25-30-256-257-258-259-260,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 163, "name": "163 (0x00a3)", "known": false }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 162, "name": "162 (0x00a2)", "known": false }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 106, "name": "106 (0x006a)", "known": false }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 64, "name": "64 (0x0040)", "known": false }, { "value": 49198, "name": "49198 (0xc02e)", "known": false }, { "value": 49202, "name": "49202 (0xc032)", "known": false }, { "value": 49197, "name": "49197 (0xc02d)", "known": false }, { "value": 49201, "name": "49201 (0xc031)", "known": false }, { "value": 49190, "name": "49190 (0xc026)", "known": false }, { "value": 49194, "name": "49194 (0xc02a)", "known": false }, { "value": 49189, "name": "49189 (0xc025)", "known": false }, { "value": 49193, "name": "49193 (0xc029)", "known": false }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 56, "name": "56 (0x0038)", "known": false }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 50, "name": "50 (0x0032)", "known": false }, { "value": 49157, "name": "49157 (0xc005)", "known": false }, { "value": 49167, "name": "49167 (0xc00f)", "known": false }, { "value": 49156, "name": "49156 (0xc004)", "known": false }, { "value": 49166, "name": "49166 (0xc00e)", "known": false }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 17, "name": "status_request_v2", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 50, "name": "signature_algorithms_cert", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true }, { "value": 258, "name": "ffdhe4096", "known": true }, { "value": 259, "name": "259 (0x0103)", "known": false }, { "value": 260, "name": "260 (0x0104)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1451, "first_seen": 1787488881, "last_seen": 1791550923, "transport": "t", "ja3_hash": "8bd06f4341a65d44a68bd2cef7cbedc6", "ja3_variant_count": 1, "ja3_variants": [ "8bd06f4341a65d44a68bd2cef7cbedc6" ], "user_agents": { "LinkedInBot/1.0 (compatible; Mozilla/5.0; Apache-HttpClient +http://www.linkedin.com)": 89, "Mozilla/5.0 (compatible; IbouBot/1.0; +bot@ibou.io; +https://ibou.io/iboubot.html)": 31, "Mozilla/5.0 (compatible; Barkrowler/0.9; +https://babbar.tech/crawler)": 70 }, "ua_disagreement": true } }, { "hash": "t13d521200_b262b3658495_b722ecb35a82", "kind": "ja4", "tier": "observed", "classification": "api_client", "description": "axios \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d521200", "b": "b262b3658495", "c": "b722ecb35a82", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 52, "extension_count": 12, "alpn": null } }, "ja3_string": "771,4866-4867-4865-49199-49195-49200-49196-158-49191-103-49192-107-163-159-52393-52392-52394-49325-49311-49245-49249-49239-49235-162-49324-49310-49244-49248-49238-49234-49188-106-49187-64-49162-49172-57-56-49161-49171-51-50-157-49309-49233-156-49308-49232-61-60-53-47,65281-0-11-10-35-22-23-13-43-45-51-41,4588-29-23-30-24-25-256-257,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 163, "name": "163 (0x00a3)", "known": false }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49325, "name": "TLS_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49311, "name": "TLS_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49245, "name": "49245 (0xc05d)", "known": false }, { "value": 49249, "name": "TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_CBC_SHA384", "known": true }, { "value": 49239, "name": "49239 (0xc057)", "known": false }, { "value": 49235, "name": "49235 (0xc053)", "known": false }, { "value": 162, "name": "162 (0x00a2)", "known": false }, { "value": 49324, "name": "TLS_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49310, "name": "TLS_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49244, "name": "49244 (0xc05c)", "known": false }, { "value": 49248, "name": "TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 49238, "name": "49238 (0xc056)", "known": false }, { "value": 49234, "name": "49234 (0xc052)", "known": false }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 106, "name": "106 (0x006a)", "known": false }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 64, "name": "64 (0x0040)", "known": false }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 56, "name": "56 (0x0038)", "known": false }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 50, "name": "50 (0x0032)", "known": false }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49309, "name": "TLS_DHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49233, "name": "49233 (0xc051)", "known": false }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49308, "name": "TLS_DHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49232, "name": "49232 (0xc050)", "known": false }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 41, "name": "pre_shared_key", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 6, "first_seen": 1789360804, "last_seen": 1790639478, "transport": "t", "ja3_hash": "3071e91916919685206127280b6af9bf", "ja3_variant_count": 1, "ja3_variants": [ "3071e91916919685206127280b6af9bf" ], "user_agents": { "axios/1.18.1": 7, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/141.0.0.0 Safari/537.36": 1 }, "ua_disagreement": true } }, { "hash": "t13d7512ht_479067518aa3_d89d4c7b8e02", "kind": "ja4", "tier": "observed", "classification": "api_client", "description": "Python requests \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13d7512ht", "b": "479067518aa3", "c": "d89d4c7b8e02", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 75, "extension_count": 12, "alpn": "ht" } }, "ja3_string": "771,4866-4867-4865-49196-49200-163-159-52393-52392-52394-49327-49325-49315-49311-49245-49249-49239-49235-49195-49199-162-158-49326-49324-49314-49310-49244-49248-49238-49234-49188-49192-107-106-49267-49271-196-195-49187-49191-103-64-49266-49270-190-189-49162-49172-57-56-136-135-49161-49171-51-50-69-68-157-49313-49309-49233-156-49312-49308-49232-61-192-60-186-53-132-47-65-255,0-11-10-16-22-23-49-13-43-45-51-21,29-23-30-25-24-256-257-258-259-260,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 163, "name": "163 (0x00a3)", "known": false }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49327, "name": "TLS_DHE_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49325, "name": "TLS_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49315, "name": "TLS_ECDHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49311, "name": "TLS_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49245, "name": "49245 (0xc05d)", "known": false }, { "value": 49249, "name": "TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_CBC_SHA384", "known": true }, { "value": 49239, "name": "49239 (0xc057)", "known": false }, { "value": 49235, "name": "49235 (0xc053)", "known": false }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 162, "name": "162 (0x00a2)", "known": false }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49326, "name": "TLS_DHE_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49324, "name": "TLS_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49314, "name": "TLS_ECDHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49310, "name": "TLS_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49244, "name": "49244 (0xc05c)", "known": false }, { "value": 49248, "name": "TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 49238, "name": "49238 (0xc056)", "known": false }, { "value": 49234, "name": "49234 (0xc052)", "known": false }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 106, "name": "106 (0x006a)", "known": false }, { "value": 49267, "name": "TLS_ECDHE_RSA_WITH_CAMELLIA_256_CBC_SHA384", "known": true }, { "value": 49271, "name": "TLS_RSA_WITH_CAMELLIA_256_GCM_SHA384", "known": true }, { "value": 196, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA256", "known": true }, { "value": 195, "name": "195 (0x00c3)", "known": false }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 64, "name": "64 (0x0040)", "known": false }, { "value": 49266, "name": "TLS_ECDHE_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 49270, "name": "TLS_RSA_WITH_CAMELLIA_128_GCM_SHA256", "known": true }, { "value": 190, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 189, "name": "189 (0x00bd)", "known": false }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 56, "name": "56 (0x0038)", "known": false }, { "value": 136, "name": "TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 135, "name": "135 (0x0087)", "known": false }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 50, "name": "50 (0x0032)", "known": false }, { "value": 69, "name": "TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 68, "name": "68 (0x0044)", "known": false }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49313, "name": "TLS_ECDHE_ECDSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49309, "name": "TLS_DHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49233, "name": "49233 (0xc051)", "known": false }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49312, "name": "TLS_ECDHE_ECDSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49308, "name": "TLS_DHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 49232, "name": "49232 (0xc050)", "known": false }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 192, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 186, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 132, "name": "TLS_RSA_WITH_CAMELLIA_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 65, "name": "TLS_RSA_WITH_CAMELLIA_128_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 49, "name": "post_handshake_auth", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 21, "name": "padding", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true }, { "value": 258, "name": "ffdhe4096", "known": true }, { "value": 259, "name": "259 (0x0103)", "known": false }, { "value": 260, "name": "260 (0x0104)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 6, "first_seen": 1787621166, "last_seen": 1791221538, "transport": "t", "ja3_hash": "8a889e7a3d15642aeb93d20a85a5a1ca", "ja3_variant_count": 1, "ja3_variants": [ "8a889e7a3d15642aeb93d20a85a5a1ca" ], "user_agents": { "python-requests/2.31.0": 3, "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.6312.86 Safari/537.36 BitSightBot/1.0": 1, "Mozilla/5.0 (compatible; Baiduspider/2.0; +http://www.baidu.com/search/spider.html)": 1 }, "ua_disagreement": true } }, { "hash": "t13i1010h2_18ef40b21276_ed9a35a78dfa", "kind": "ja4", "tier": "observed", "classification": "api_client", "description": "curl \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1010h2", "b": "18ef40b21276", "c": "ed9a35a78dfa", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 10, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49196-49200-52393-52392-49195-49199-49191,23-65281-10-11-35-16-13-51-45-43,29-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 2, "first_seen": 1790948736, "last_seen": 1791346049, "transport": "t", "ja3_hash": "a1b77074bab81e5056ba398e26f31871", "ja3_variant_count": 1, "ja3_variants": [ "a1b77074bab81e5056ba398e26f31871" ], "user_agents": { "curl/8.7.1": 34 }, "ua_disagreement": false } }, { "hash": "t13i131100_f57a46bbacb6_9249cab70c77", "kind": "ja4", "tier": "observed", "classification": "api_client", "description": "Amazonbot \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i131100", "b": "f57a46bbacb6", "c": "9249cab70c77", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 13, "extension_count": 11, "alpn": null } }, "ja3_string": "771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-4865-4866-4867,11-35-65281-23-18-5-10-13-43-51-45,4588-29-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 20, "first_seen": 1787501111, "last_seen": 1789208912, "transport": "t", "ja3_hash": "d8e37a40e57dedd5cdf50f846ffca8f8", "ja3_variant_count": 1, "ja3_variants": [ "d8e37a40e57dedd5cdf50f846ffca8f8" ], "user_agents": { "Mozilla/5.0 (compatible; Amzn-SearchBot/1.0; +https://developer.amazon.com/support/amazonbot)": 5, "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; GPTBot/1.4; +https://openai.com/gptbot)": 2, "Mozilla/5.0 (compatible; Amazonbot/0.1; +https://developer.amazon.com/support/amazonbot)": 3 }, "ua_disagreement": false } }, { "hash": "t13i1311h2_f57a46bbacb6_d86ca3cca451", "kind": "ja4", "tier": "observed", "classification": "api_client", "description": "curl \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1311h2", "b": "f57a46bbacb6", "c": "d86ca3cca451", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 13, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-4865-4866-4867,11-65281-23-18-5-10-13-50-16-43-51,4588-29-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 50, "name": "signature_algorithms_cert", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 284, "first_seen": 1787461146, "last_seen": 1791559680, "transport": "t", "ja3_hash": "8c5b2f378e481f94b4f82c131798f4d4", "ja3_variant_count": 3, "ja3_variants": [ "8c5b2f378e481f94b4f82c131798f4d4", "ee4dbd7875058c5fdff9c33a744fc786", "d5de6ac0e5cfb85b9a91508128424b99" ], "user_agents": { "Mozilla/5.0 (Linux; U; Android 2.2; en-us; Droid Build/FRG22D) AppleWebKit/533.1 (KHTML, like Gecko) Version/4.0 Mobile Safari/533.1": 5, "Mozilla/5.0 (Linux; Android 5.1; itel it1407 Build/LMY47D) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/39.0.0.0 Mobile Safari/537.36": 5, "curl/7.74.0": 50, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Chrome/125 Safari/537.36": 2 }, "ua_disagreement": true } }, { "hash": "t13i140900_cbb2034c60b8_e7c285222651", "kind": "ja4", "tier": "observed", "classification": "api_client", "description": "Go net/http \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i140900", "b": "cbb2034c60b8", "c": "e7c285222651", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 14, "extension_count": 9, "alpn": null } }, "ja3_string": "771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-49170-4865-4866-4867,5-10-11-13-65281-23-18-43-51,29-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 205, "first_seen": 1787451678, "last_seen": 1791537293, "transport": "t", "ja3_hash": "ea4a9ae049cfc614efbb3c244abb3fc7", "ja3_variant_count": 2, "ja3_variants": [ "ea4a9ae049cfc614efbb3c244abb3fc7", "1487bd354c20f20dd642bebc7f706e95" ], "user_agents": { "Mozilla/5.0": 66, "-": 62, "Go-http-client/1.1": 124, "net-research-scan/1.0 (+https://example.org/scan-info; abuse contact)": 3, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36": 47 }, "ua_disagreement": true } }, { "hash": "t13i150700_8daaf6152771_04c8947933f4", "kind": "ja4", "tier": "observed", "classification": "api_client", "description": "Sogou spider \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i150700", "b": "8daaf6152771", "c": "04c8947933f4", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,43-23-10-18-65037-65281-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791077820, "last_seen": 1791077820, "transport": "t", "ja3_hash": "fae739f09fb293735a4b057c8b119070", "ja3_variant_count": 1, "ja3_variants": [ "fae739f09fb293735a4b057c8b119070" ], "user_agents": { "Sogou web spider/4.0(+http://www.sogou.com/docs/help/webmasters.htm#07)": 12 }, "ua_disagreement": false } }, { "hash": "t13i151000_8daaf6152771_6987ffba45e0", "kind": "ja4", "tier": "observed", "classification": "api_client", "description": "Bingbot \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i151000", "b": "8daaf6152771", "c": "6987ffba45e0", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-65281-35-10-43-17613-5-13-27-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790890827, "last_seen": 1790890827, "transport": "t", "ja3_hash": "8b04702696d4113f07ca5fe6d955e0e0", "ja3_variant_count": 1, "ja3_variants": [ "8b04702696d4113f07ca5fe6d955e0e0" ], "user_agents": { "Mozilla/5.0 (compatible; bingbot/2.0; +http://www.bing.com/bingbot.htm)": 1 }, "ua_disagreement": false } }, { "hash": "t13i1511h2_8daaf6152771_3f473c87c81c", "kind": "ja4", "tier": "observed", "classification": "api_client", "description": "Googlebot \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1511h2", "b": "8daaf6152771", "c": "3f473c87c81c", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-45-43-35-16-65037-5-10-18-27-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791007038, "last_seen": 1791007038, "transport": "t", "ja3_hash": "b43be59569dfb1a1270774cb2da45e33", "ja3_variant_count": 1, "ja3_variants": [ "b43be59569dfb1a1270774cb2da45e33" ], "user_agents": { "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)": 1 }, "ua_disagreement": false } }, { "hash": "t13i1514h2_8daaf6152771_e6dcd7dc0a04", "kind": "ja4", "tier": "observed", "classification": "api_client", "description": "Sogou spider \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1514h2", "b": "8daaf6152771", "c": "e6dcd7dc0a04", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 15, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-17613-65281-35-13-45-18-10-16-27-5-65037-43-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 3, "first_seen": 1790773536, "last_seen": 1791244355, "transport": "t", "ja3_hash": "32c4566985c1d785c0b9d55a7c819218", "ja3_variant_count": 3, "ja3_variants": [ "32c4566985c1d785c0b9d55a7c819218", "1e0ad6c3b9461f25677294248afd5ff4", "f3a416a970b0aa2c941c154d79727d59" ], "user_agents": { "Mozilla/5.0 (Linux; Android 15; CPH2653) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Mobile Safari/537.36": 1, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Brave/134": 1, "Sogou web spider/4.0(+http://www.sogou.com/docs/help/webmasters.htm#07)": 12 }, "ua_disagreement": true } }, { "hash": "t13i1811ht_85036bcba153_aaee209e3cc1", "kind": "ja4", "tier": "observed", "classification": "api_client", "description": "Python requests \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i1811ht", "b": "85036bcba153", "c": "aaee209e3cc1", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 18, "extension_count": 11, "alpn": "ht" } }, "ja3_string": "771,4866-4867-4865-49196-49200-49195-49199-52393-52392-49188-49192-49187-49191-159-158-107-103-255,11-10-16-22-23-49-13-43-45-51-21,29-23-30-25-24-256-257-258-259-260,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 49, "name": "post_handshake_auth", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 21, "name": "padding", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true }, { "value": 258, "name": "ffdhe4096", "known": true }, { "value": 259, "name": "259 (0x0103)", "known": false }, { "value": 260, "name": "260 (0x0104)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 133, "first_seen": 1787577809, "last_seen": 1791513366, "transport": "t", "ja3_hash": "b885946e72ad51dca6c70abc2f773506", "ja3_variant_count": 2, "ja3_variants": [ "b885946e72ad51dca6c70abc2f773506", "4b510481e2e54d5956f56d2177fb122d" ], "user_agents": { "python-requests/2.32.3": 2, "python-requests/2.31.0": 4, "Mozilla/5.0 (Linux; U; Android 4.4.2; en-US; HM NOTE 1W Build/KOT49H) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 UCBrowser/11.0.5.850 U3/0.8.0 Mobile Safari/534.30": 5, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.129 Safari/537.36": 2, "python-requests/2.32.5": 43, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36": 12 }, "ua_disagreement": true } }, { "hash": "t13i190900_9dc949149365_e7c285222651", "kind": "ja4", "tier": "observed", "classification": "api_client", "description": "Go net/http \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i190900", "b": "9dc949149365", "c": "e7c285222651", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 19, "extension_count": 9, "alpn": null } }, "ja3_string": "771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-156-157-47-53-49170-10-4865-4866-4867,5-10-11-13-65281-23-18-43-51,29-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 246, "first_seen": 1787475201, "last_seen": 1791417719, "transport": "t", "ja3_hash": "d6828e30ab66774a91a96ae93be4ae4c", "ja3_variant_count": 3, "ja3_variants": [ "d6828e30ab66774a91a96ae93be4ae4c", "9460af62ae0af667130bf0d36514f084", "dca978999497239c063576533ea34cce" ], "user_agents": { "Mozilla/5.0 Gecko/20100101": 1, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36": 4, "l9tcpid/v1.1.0": 7, "l9explore/1.2.2": 93, "Go-http-client/1.1": 25, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36": 23, "NTRIP GNSSInternetRadio": 5 }, "ua_disagreement": true } }, { "hash": "t13i191000_9dc949149365_e5728521abd4", "kind": "ja4", "tier": "observed", "classification": "api_client", "description": "Go net/http \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i191000", "b": "9dc949149365", "c": "e5728521abd4", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 19, "extension_count": 10, "alpn": null } }, "ja3_string": "771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-156-157-47-53-49170-10-4865-4866-4867,11-65281-23-18-5-10-13-50-43-51,29-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 50, "name": "signature_algorithms_cert", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 125, "first_seen": 1787571420, "last_seen": 1791417552, "transport": "t", "ja3_hash": "96458b3de39df5d47bc5c4a9f10f8f26", "ja3_variant_count": 2, "ja3_variants": [ "96458b3de39df5d47bc5c4a9f10f8f26", "cc66f637ab6a9fd90b341744adf47775" ], "user_agents": { "l9explore/1.2.2": 68, "l9tcpid/v1.1.0": 8, "Go-http-client/1.1": 21, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.2 Safari/605.1.15": 2, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36": 1 }, "ua_disagreement": true } }, { "hash": "t13i2011h1_2b729b4bf6f3_efddba432950", "kind": "ja4", "tier": "observed", "classification": "api_client", "description": "curl \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i2011h1", "b": "2b729b4bf6f3", "c": "efddba432950", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 20, "extension_count": 11, "alpn": "h1" } }, "ja3_string": "771,4866-4865-49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47,43-13-35-10-11-16-51-49-23-65281-45,29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true } ], "extensions": [ { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 49, "name": "post_handshake_auth", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 2, "first_seen": 1791541811, "last_seen": 1791541815, "transport": "t", "ja3_hash": "4bb46cf214a6498c7fa9f4e7bf940333", "ja3_variant_count": 1, "ja3_variants": [ "4bb46cf214a6498c7fa9f4e7bf940333" ], "user_agents": { "curl/8.19.0": 2 }, "ua_disagreement": false } }, { "hash": "t13i3111h2_e8f1e7e78f70_aaee209e3cc1", "kind": "ja4", "tier": "observed", "classification": "api_client", "description": "curl \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i3111h2", "b": "e8f1e7e78f70", "c": "aaee209e3cc1", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 31, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4866-4867-4865-49196-49200-159-52393-52392-52394-49195-49199-158-49188-49192-107-49187-49191-103-49162-49172-57-49161-49171-51-157-156-61-60-53-47-255,11-10-16-22-23-49-13-43-45-51-21,29-23-30-25-24-256-257-258-259-260,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 49, "name": "post_handshake_auth", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 21, "name": "padding", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true }, { "value": 258, "name": "ffdhe4096", "known": true }, { "value": 259, "name": "259 (0x0103)", "known": false }, { "value": 260, "name": "260 (0x0104)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 72, "first_seen": 1788139563, "last_seen": 1791508800, "transport": "t", "ja3_hash": "78f0dc5ac5b19daf131a133cfdee9691", "ja3_variant_count": 1, "ja3_variants": [ "78f0dc5ac5b19daf131a133cfdee9691" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 3, "Mozilla/5.0 (Windows NT 10.0; Win64; x64)": 33, "curl/8.18.0-DEV": 12 }, "ua_disagreement": true } }, { "hash": "t13i3111ht_e8f1e7e78f70_a3954c448de3", "kind": "ja4", "tier": "observed", "classification": "api_client", "description": "Python aiohttp \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i3111ht", "b": "e8f1e7e78f70", "c": "a3954c448de3", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 31, "extension_count": 11, "alpn": "ht" } }, "ja3_string": "771,4866-4867-4865-49196-49200-159-52393-52392-52394-49195-49199-158-49188-49192-107-49187-49191-103-49162-49172-57-49161-49171-51-157-156-61-60-53-47-255,11-10-35-16-22-23-13-43-45-51-21,29-23-30-25-24-256-257-258-259-260,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 21, "name": "padding", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true }, { "value": 258, "name": "ffdhe4096", "known": true }, { "value": 259, "name": "259 (0x0103)", "known": false }, { "value": 260, "name": "260 (0x0104)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 34, "first_seen": 1787831220, "last_seen": 1791574874, "transport": "t", "ja3_hash": "755cbaaa441626ab9e759e8982278df5", "ja3_variant_count": 1, "ja3_variants": [ "755cbaaa441626ab9e759e8982278df5" ], "user_agents": { "Python/3.12 aiohttp/3.13.5": 2, "PAN GlobalProtect": 6, "python-urllib3/2.7.0": 42 }, "ua_disagreement": false } }, { "hash": "t13i351400_8f004308c246_d8a2da3f94cd", "kind": "ja4", "tier": "observed", "classification": "api_client", "description": "Go net/http \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i351400", "b": "8f004308c246", "c": "d8a2da3f94cd", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 35, "extension_count": 14, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53-49191-49187-49161-49162-52394-158-159-103-107-51-57-60-49170-22-10-5-49169-49159-52243-52244,45-23-65281-17613-10-5-43-35-13-11-51-27-65037-18,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49170, "name": "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 22, "name": "TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true }, { "value": 5, "name": "TLS_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 49169, "name": "TLS_ECDHE_RSA_WITH_RC4_128_SHA", "known": true }, { "value": 49159, "name": "TLS_ECDHE_ECDSA_WITH_RC4_128_SHA", "known": true }, { "value": 52243, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 (draft)", "known": true }, { "value": 52244, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256 (draft)", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 22, "first_seen": 1790499860, "last_seen": 1791517962, "transport": "t", "ja3_hash": "6e4e34f4fd5ecf3adcdaf6d27cf83f69", "ja3_variant_count": 22, "ja3_variants": [ "6e4e34f4fd5ecf3adcdaf6d27cf83f69", "f29870952dc9f5ff7a2928a73888b198", "adf701d137b0e1898cabab338b7030e5", "a737d88ddbab0ff97b48c86996d5df4d", "3e07cf7c4d12f1d8e29bd7cef77cc06a", "58fae890fe22493e0ed36ea6244dddb7", "773d3cad3100f710627f6016ea83e7e4", "4c4982ae5f58e8f41dc1dc31d0870125", "31d72c031ff7907baa82992f00dfb6c8", "d352a2c84426ecc21529cab12beb72a5", "d0c9edfdaf46347f9de1c113e87e7d38", "b00b682600cb734cd0d86e51888b2873" ], "user_agents": { "Go-http-client/1.1": 14 }, "ua_disagreement": false } }, { "hash": "t13i3514h2_bfa337485184_45c22c8f5b22", "kind": "ja4", "tier": "observed", "classification": "api_client", "description": "curl \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i3514h2", "b": "bfa337485184", "c": "45c22c8f5b22", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 35, "extension_count": 14, "alpn": "h2" } }, "ja3_string": "771,4866-4867-4865-4868-49196-49200-52393-52392-49325-49195-49199-49324-49187-49191-49162-49172-49161-49171-157-49309-156-49308-61-60-53-47-159-52394-49311-158-49310-107-103-57-51,65281-11-10-13172-16-22-23-49-13-43-45-51-27-21,29-23-30-25-24-256-257-258-259-260,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4868, "name": "TLS_AES_128_CCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49325, "name": "TLS_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49324, "name": "TLS_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49309, "name": "TLS_DHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49308, "name": "TLS_DHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49311, "name": "TLS_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49310, "name": "TLS_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13172, "name": "13172 (0x3374)", "known": false }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 49, "name": "post_handshake_auth", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 21, "name": "padding", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true }, { "value": 258, "name": "ffdhe4096", "known": true }, { "value": 259, "name": "259 (0x0103)", "known": false }, { "value": 260, "name": "260 (0x0104)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 5, "first_seen": 1789042913, "last_seen": 1790194597, "transport": "t", "ja3_hash": "63ca17cf3b8345665a5c45e90ffeb33e", "ja3_variant_count": 1, "ja3_variants": [ "63ca17cf3b8345665a5c45e90ffeb33e" ], "user_agents": { "curl/7.76.1": 5 }, "ua_disagreement": false } }, { "hash": "t13i3612ht_bcee18a5b459_cde28b4b7b1f", "kind": "ja4", "tier": "observed", "classification": "api_client", "description": "Python requests \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t13i3612ht", "b": "bcee18a5b459", "c": "cde28b4b7b1f", "properties": { "transport": "TCP", "tls_version": "TLS 1.3", "sni": "no server name (IP literal)", "cipher_count": 36, "extension_count": 12, "alpn": "ht" } }, "ja3_string": "771,4866-4867-4865-49196-49200-49195-49199-52393-52392-159-158-52394-49325-49324-49188-49192-49187-49191-49162-49172-49161-49171-49311-49310-107-103-57-51-157-156-49309-49308-61-60-53-47,65281-11-10-16-22-23-49-13-43-45-51-27,4588-29-23-30-24-25-256-257,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 159, "name": "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 158, "name": "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52394, "name": "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49325, "name": "TLS_RSA_WITH_AES_256_CCM", "known": true }, { "value": 49324, "name": "TLS_RSA_WITH_AES_128_CCM", "known": true }, { "value": 49188, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49192, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "known": true }, { "value": 49187, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49191, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49311, "name": "TLS_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49310, "name": "TLS_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 107, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 103, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49309, "name": "TLS_DHE_RSA_WITH_ARIA_256_GCM_SHA384", "known": true }, { "value": 49308, "name": "TLS_DHE_RSA_WITH_ARIA_128_GCM_SHA256", "known": true }, { "value": 61, "name": "TLS_RSA_WITH_AES_256_CBC_SHA256", "known": true }, { "value": 60, "name": "TLS_RSA_WITH_AES_128_CBC_SHA256", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 49, "name": "post_handshake_auth", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 27, "name": "compress_certificate", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 58, "first_seen": 1787558089, "last_seen": 1791573670, "transport": "t", "ja3_hash": "d18b223ce817c861b7829130500395c2", "ja3_variant_count": 1, "ja3_variants": [ "d18b223ce817c861b7829130500395c2" ], "user_agents": { "python-requests/2.34.2": 24, "python-requests/2.32.5": 25, "Mozilla/5.0 (Windows NT 6.2;en-US) AppleWebKit/537.32.36 (KHTML, live Gecko) Chrome/50.0.3109.73 Safari/537.32": 1 }, "ua_disagreement": true } }, { "hash": "q13d0310h3_55b375c5d22e_6da5d9173cfb", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "q13d0310h3", "b": "55b375c5d22e", "c": "6da5d9173cfb", "properties": { "transport": "QUIC", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 3, "extension_count": 10, "alpn": "h3" } }, "ja3_string": "771,4865-4866-4867,10-27-16-57-17613-45-43-0-13-51,29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 57, "name": "quic_transport_parameters", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 19, "first_seen": 1789268786, "last_seen": 1791236478, "transport": "q", "ja3_hash": "dcc2d36031cfc8f1758dec50cf4dbba5", "ja3_variant_count": 19, "ja3_variants": [ "dcc2d36031cfc8f1758dec50cf4dbba5", "13291f7e989ef9078829bdacc727003d", "c52ecc5f68cd0b99a05c1eeb50a745a0", "d502d3f4859a5916daf9ca1f625ce3a8", "c41d38f80b35c932352cfb7c2d1f39d2", "634a67cd8d11152117274a45e2daaa48", "48050d6543b1c707f7db5953f4b0d811", "a43dbc8b1fa728fc6781aac91565525a", "1413848ee6f2fbf0486a84dd156b937f", "bfc03ebb14860d45c31fac28af7269e8", "275c834bc7c0031d298aecfa910c79b1", "a8acb2b7b1d1c3c286abc17015f25cfb" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36 Edg/153.0.0.0": 34, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Mobile Safari/537.36": 197, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Mobile Safari/537.36": 21 }, "ua_disagreement": false } }, { "hash": "q13d0310h3_55b375c5d22e_85bcee6495dd", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "q13d0310h3", "b": "55b375c5d22e", "c": "85bcee6495dd", "properties": { "transport": "QUIC", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 3, "extension_count": 10, "alpn": "h3" } }, "ja3_string": "771,4865-4866-4867,16-13-27-17513-57-10-0-45-43-51,29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 17513, "name": "application_settings", "known": true }, { "value": 57, "name": "quic_transport_parameters", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 45, "first_seen": 1788567465, "last_seen": 1791515513, "transport": "q", "ja3_hash": "c94be6b093daca916ee93d77de6abdfb", "ja3_variant_count": 45, "ja3_variants": [ "c94be6b093daca916ee93d77de6abdfb", "274f089feba48f910773bd3b807e5f31", "c13317c8e8eb6e23a2417b5b21456396", "2291471f6c6dcfa2af8e373209ec9d21", "f0bc0b5645ff4711f8c47a7416aa29eb", "56e134663997b8633460e79b2527a525", "bb6fdd74c3e3760a17ac9e1744da3e70", "693a5b28ce544303805530643a37495c", "bd80cd42471c1cbd33a327c4f83dd1a9", "0e7adbee6738adec2ff2fa6f871d9543", "e9952e1b1acebde913b7d2eab13bc18b", "7f8f9cfc954524e56dcaa57e49ae5bee" ], "user_agents": { "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/114.0.5720.0 Safari/537.36": 3, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.138 Safari/537.36": 12, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36": 8, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36": 190, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36": 196, "Mozilla/5.0 (iPhone; CPU iPhone OS 14_4 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/15.4 Mobile/15E148 Safari/604.1": 145, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_6) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/13.1.2 Safari/605.1.15": 9 }, "ua_disagreement": true } }, { "hash": "q13d0311h3_55b375c5d22e_00d49a47e7d1", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "q13d0311h3", "b": "55b375c5d22e", "c": "00d49a47e7d1", "properties": { "transport": "QUIC", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 3, "extension_count": 11, "alpn": "h3" } }, "ja3_string": "771,4865-4866-4867,13-65037-0-43-57-16-10-17513-51-45-27,29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 57, "name": "quic_transport_parameters", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 17513, "name": "application_settings", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 27, "name": "compress_certificate", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 20, "first_seen": 1788460628, "last_seen": 1791551920, "transport": "q", "ja3_hash": "17a6afe8f7023de9860d0f571f00149c", "ja3_variant_count": 20, "ja3_variants": [ "17a6afe8f7023de9860d0f571f00149c", "6ca6f6a7aa5df2210d97469f937a49d0", "9ec7ba075891820056ce730571cfa180", "d41f14b4b586b486a6902318983297b4", "330c6f44f410b98e7faf7a98d1900d80", "517a0accc488aaeb9724326e5fc9bb94", "545ec20959a7f012cfd66dfbd7d67ff0", "4c23198d1a564f0a46db1fa9503da8a8", "3173dc24950f17c77df156278708de28", "49a4168776c15a9a7193f3fe2ef8fcdf", "918062656dddf6a99ed3057c367cd752", "5322e78ad093486676f724f053a67ffb" ], "user_agents": { "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 UnveilPhishingML/1.0 (+https://sitereview.unveiltech.com/)": 1, "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.6312.86 Safari/537.36 BitSightBot/1.0": 6, "Mozilla/5.0 (Linux; arm_64; Android 15; 2505DRP06G) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.6998.94 YaBrowser/25.4.5.94.01 Safari/537.36": 18, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.6367.78 Safari/537.36": 1, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36": 3 }, "ua_disagreement": false } }, { "hash": "q13d0311h3_55b375c5d22e_2680ea4b03be", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Firefox \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "q13d0311h3", "b": "55b375c5d22e", "c": "2680ea4b03be", "properties": { "transport": "QUIC", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 3, "extension_count": 11, "alpn": "h3" } }, "ja3_string": "771,4865-4867-4866,65037-43-0-10-5-13-34-28-16-51-57,4588-29-23-24-25,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 34, "name": "34 (0x0022)", "known": false }, { "value": 28, "name": "record_size_limit", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 57, "name": "quic_transport_parameters", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [] }, "observed": { "count": 2, "first_seen": 1788727392, "last_seen": 1788727502, "transport": "q", "ja3_hash": "be6737014bc03094c57d5fe1515c5c60", "ja3_variant_count": 2, "ja3_variants": [ "be6737014bc03094c57d5fe1515c5c60", "3ff1351e93027ca6fe52733bd6f2dab6" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:140.0) Gecko/20100101 Firefox/140.0": 38 }, "ua_disagreement": false } }, { "hash": "q13d0311h3_55b375c5d22e_36ae49fd04fe", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "q13d0311h3", "b": "55b375c5d22e", "c": "36ae49fd04fe", "properties": { "transport": "QUIC", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 3, "extension_count": 11, "alpn": "h3" } }, "ja3_string": "771,4866-4867-4865,0-10-16-5-13-18-51-45-43-57-27,4588-29-23-24-25,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 57, "name": "quic_transport_parameters", "known": true }, { "value": 27, "name": "compress_certificate", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [] }, "observed": { "count": 394, "first_seen": 1787488746, "last_seen": 1791571152, "transport": "q", "ja3_hash": "48d08f334704479db85d91df80039756", "ja3_variant_count": 3, "ja3_variants": [ "48d08f334704479db85d91df80039756", "9a78264e64e221797705e75a3c55df01", "2f9431e877b01e163774ae4ae0df9ded" ], "user_agents": { "Mozilla/5.0 (iPhone; CPU iPhone OS 26_6_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/152.0.7977.53 Mobile/15E148 Safari/604.1": 271, "Mozilla/5.0 (iPhone; CPU iPhone OS 26_3_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) EdgiOS/151.0.4129.72 Version/26.0 Mobile/15E148 Safari/604.1": 1738, "Mozilla/5.0 (iPhone; CPU iPhone OS 18_7 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/26.6 Mobile/15E148 Safari/604.1": 105, "Mozilla/5.0 (iPhone; CPU iPhone OS 18_5 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.5 Mobile/15E148 Safari/604.1": 31, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.4 Safari/605.1.15": 11, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/26.5 Safari/605.1.15 Ddg/26.5": 128 }, "ua_disagreement": false } }, { "hash": "q13d0311h3_55b375c5d22e_6f167c9f8fb3", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "q13d0311h3", "b": "55b375c5d22e", "c": "6f167c9f8fb3", "properties": { "transport": "QUIC", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 3, "extension_count": 11, "alpn": "h3" } }, "ja3_string": "771,4865-4866-4867,27-10-45-51-0-57-13-17613-16-43-41,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 57, "name": "quic_transport_parameters", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 41, "name": "pre_shared_key", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790651504, "last_seen": 1790651504, "transport": "q", "ja3_hash": "9c5d6cea449054e90f886645e11d2cb6", "ja3_variant_count": 1, "ja3_variants": [ "9c5d6cea449054e90f886645e11d2cb6" ], "user_agents": { "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Mobile Safari/537.36": 4 }, "ua_disagreement": false } }, { "hash": "q13d0311h3_55b375c5d22e_902c7b017c92", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "q13d0311h3", "b": "55b375c5d22e", "c": "902c7b017c92", "properties": { "transport": "QUIC", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 3, "extension_count": 11, "alpn": "h3" } }, "ja3_string": "771,4865-4866-4867,27-45-17513-16-0-10-57-43-13-51-41,29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 17513, "name": "application_settings", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 57, "name": "quic_transport_parameters", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 41, "name": "pre_shared_key", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 2, "first_seen": 1790220348, "last_seen": 1790230983, "transport": "q", "ja3_hash": "cd413a2ff5e0f59ffeb0fc9a6d0af12e", "ja3_variant_count": 2, "ja3_variants": [ "cd413a2ff5e0f59ffeb0fc9a6d0af12e", "d3bcf2bd1ec3d83faa34e88574d43f0c" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36": 51 }, "ua_disagreement": false } }, { "hash": "q13d0312h3_55b375c5d22e_08ad80460652", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "q13d0312h3", "b": "55b375c5d22e", "c": "08ad80460652", "properties": { "transport": "QUIC", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 3, "extension_count": 12, "alpn": "h3" } }, "ja3_string": "771,4865-4866-4867,17513-0-13-27-65037-51-10-45-43-57-16-41,25497-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true } ], "extensions": [ { "value": 17513, "name": "application_settings", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 57, "name": "quic_transport_parameters", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 41, "name": "pre_shared_key", "known": true } ], "curves": [ { "value": 25497, "name": "X25519Kyber768Draft00", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 2, "first_seen": 1788555907, "last_seen": 1790349869, "transport": "q", "ja3_hash": "d52220cd211a7ba2a7de88755f370c80", "ja3_variant_count": 2, "ja3_variants": [ "d52220cd211a7ba2a7de88755f370c80", "b37fea1b291ec2f8d7f15080574d5122" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36": 3, "Mozilla/5.0 (Linux; arm_64; Android 15; 2505DRP06G) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.6998.94 YaBrowser/25.4.5.94.01 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "q13d0312h3_55b375c5d22e_35ab28bf858e", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "q13d0312h3", "b": "55b375c5d22e", "c": "35ab28bf858e", "properties": { "transport": "QUIC", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 3, "extension_count": 12, "alpn": "h3" } }, "ja3_string": "771,4866-4867-4865,0-10-16-5-13-18-51-45-43-57-27-41,4588-29-23-24-25,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 57, "name": "quic_transport_parameters", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 41, "name": "pre_shared_key", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [] }, "observed": { "count": 373, "first_seen": 1787488758, "last_seen": 1791570420, "transport": "q", "ja3_hash": "94f0e94ff0087a03f09b681a965a4d96", "ja3_variant_count": 1, "ja3_variants": [ "94f0e94ff0087a03f09b681a965a4d96" ], "user_agents": { "Mozilla/5.0 (iPhone; CPU iPhone OS 18_7 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/26.6 Mobile/15E148 Safari/604.1": 62, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/26.5.2 Safari/605.1.15": 24, "Mozilla/5.0 (iPhone; CPU iPhone OS 26_6_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/152.0.7977.53 Mobile/15E148 Safari/604.1": 134 }, "ua_disagreement": false } }, { "hash": "q13d0312h3_55b375c5d22e_c5d60a76a678", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "q13d0312h3", "b": "55b375c5d22e", "c": "c5d60a76a678", "properties": { "transport": "QUIC", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 3, "extension_count": 12, "alpn": "h3" } }, "ja3_string": "771,4865-4866-4867,65037-0-16-10-17613-51-45-27-13-57-4832-43,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 57, "name": "quic_transport_parameters", "known": true }, { "value": 4832, "name": "4832 (0x12e0)", "known": false }, { "value": 43, "name": "supported_versions", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 8, "first_seen": 1788481426, "last_seen": 1789754313, "transport": "q", "ja3_hash": "33a7b4f60646ef4d0b69298d9b2371a7", "ja3_variant_count": 8, "ja3_variants": [ "33a7b4f60646ef4d0b69298d9b2371a7", "8359acd81e8b9e530a1a50cecef7689f", "dac581476ede4357205bc467420b4d4a", "f9afc880877274fcc4d4f28a264dda93", "36c062110eec376c4e6df97cd5409d44", "b6bf59ce68a24a1ada4f165a51fbeb34", "1548284409ad6d5583a05409ac78f458", "2a66fd8944ed02242c20ca291445eed7" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36": 76, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Mobile Safari/537.36": 20 }, "ua_disagreement": false } }, { "hash": "q13d0312h3_55b375c5d22e_da69250d5c8d", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "q13d0312h3", "b": "55b375c5d22e", "c": "da69250d5c8d", "properties": { "transport": "QUIC", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 3, "extension_count": 12, "alpn": "h3" } }, "ja3_string": "771,4865-4866-4867,45-10-65037-51764-57-51-16-43-0-27-13-17613,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 57, "name": "quic_transport_parameters", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1287, "first_seen": 1788442759, "last_seen": 1791574520, "transport": "q", "ja3_hash": "2b7b14b0d9757cf30f9a9ab6a4b37cc7", "ja3_variant_count": 1287, "ja3_variants": [ "2b7b14b0d9757cf30f9a9ab6a4b37cc7", "208483836ef1f8de8229028cedc06355", "44a31b38b27c5337380ef42e15316162", "1402273aafbb99175806565d8f2cf2e7", "56a45d6cd1c6c882e5c212317fb78e53", "379f47902d043319cf35d41e44ae5f60", "05d1ff87d7d0ab7d490b977fb2f350c8", "03b84ff4246c0b7b03f4b9d85544a51a", "65449031f444c84535e6052a84019015", "b66542a980c879b657458c47055b93dd", "ed1642fd95cce535c3ba6fbad2f8ab90", "acb18f304a6590cbaee31ce53a14360b" ], "user_agents": { "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36": 795, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Mobile Safari/537.36": 704, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36": 1479, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36": 3119, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 1640, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 1044, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 PTST/260802.202201": 90, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 534, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 2672, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 2772, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Mobile Safari/537.36": 1272, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36": 136, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 59, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/155.0.0.0 Safari/537.36": 57, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36": 22, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/153.0.0.0 Safari/537.36": 46, "PromptingBot/1.0.0": 10, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 585, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36": 22, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/155.0.0.0 Mobile Safari/537.36": 48, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 OPR/136.0.0.0": 49, "Mozilla/5.0 (Linux; Android 13; SM-A037U) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Mobile Safari/537.36": 15, "Mozilla/5.0 (compatible; ev-crawler/1.0; +https://headline.com/web-crawler)": 59, "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_4_1) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.4.1 Safari/605.1.15": 5, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36": 12, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36": 21, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML like Gecko) Chrome/152.0.0.0 Safari/537.36 PTST/260802.202201": 53, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/152.0.0.0 Safari/537.36": 25, "Mozilla/5.0 (Linux; Android 8.1.0; Moto G (4)) AppleWebKit/537.36 (KHTML like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36 PTST/260802.202201": 24, "Mozilla/5.0 (Linux; Android 8.1.0; Moto G (4)) AppleWebKit/537.36 (KHTML like Gecko) Chrome/153.0.0.0 Mobile Safari/537.36 PTST/260802.202201": 22, "Mozilla/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 32, "Mozilla/5.0 (Linux; Android 8.1.0; Moto G (4)) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36 PTST/260802.202201": 45, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36": 3, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/155.0.0.0 Safari/537.36": 3, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36": 1, "SEBot-WA": 17, "Mozilla/5.0 (Linux; Android 8.1.0; Moto G (4)) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Mobile Safari/537.36 PTST/260802.202201": 41, "Mozilla/5.0 (X11; Ubuntu; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 13 }, "ua_disagreement": true } }, { "hash": "q13d0312h3_55b375c5d22e_f60bf7ff48f5", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "q13d0312h3", "b": "55b375c5d22e", "c": "f60bf7ff48f5", "properties": { "transport": "QUIC", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 3, "extension_count": 12, "alpn": "h3" } }, "ja3_string": "771,4865-4866-4867,10-17613-51-43-13-45-57-16-27-65037-0-41,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 57, "name": "quic_transport_parameters", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 41, "name": "pre_shared_key", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 2501, "first_seen": 1788441544, "last_seen": 1791574470, "transport": "q", "ja3_hash": "4eee006ded09ea6c271afc73277a129a", "ja3_variant_count": 2501, "ja3_variants": [ "4eee006ded09ea6c271afc73277a129a", "312d9aa463bbd0782cba48dc4d989a11", "a34a5019b8e26bf008e95c3f9d17fd26", "a1019b72d97350eba463bab92150a139", "dd7c77baa9b21f666c5b797c5c02bb51", "a07bf04330080b39958afde361db2ef3", "23f54046581896cd3d863790679a82af", "5b399378dee0127090aa34d976c117a9", "1e720d938ae71886ae1433fdb8513d5c", "10123bed32caa809534a26e67be377ee", "8f0e3afcf5d9c3c85015623bbdfa8b49", "90d9864aadbd5248948016535dfc756d" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36 Edg/153.0.0.0": 54133, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 Edg/152.0.0.0": 25447, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36": 87, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36": 350, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36": 3, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36": 2356, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36 Edg/154.0.0.0": 647, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36": 1650, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/143.0.7499.4 Safari/537.36": 227, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Mobile Safari/537.36": 223, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 227, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36 Edg/148.0.0.0": 205, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/141.0.7390.0 Safari/537.36": 3, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/141.0 Safari/537.36": 25, "Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.7339.0 Safari/537.36": 9, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 1248, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36": 465, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36": 28, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Mobile Safari/537.36": 29, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0 Safari/537.36": 18, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.7444.175 Safari/537.36": 38, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.7444.163 Safari/537.36": 9, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36": 74, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36": 454, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36": 135, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36": 10, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.7444.162 Safari/537.36": 21, "Mozilla/5.0 (Linux; Android 16; SM-A166U Build/BP4A.251205.006; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/153.0.8010.36 Mobile Safari/537.36 [LinkedInApp]/2.332": 1, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 143, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/141.0.0.0 Safari/537.36": 3, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36": 7, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0 Safari/537.36": 8, "Mozilla/5.0 (Linux; Android 14; 22101316G Build/UP1A.231005.007) AppleWebKit/537.36 (KHTML, like Gecko) Qjqkk/4.0 Chrome/153.0.8010.39 Mobile Safari/537.36": 12, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 37, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 Edg/152.0.0.0": 66, "RootEvidence/1.0": 49, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Mobile Safari/537.36 EdgA/153.0.0.0": 20, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36 EdgA/152.0.0.0": 1, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0 Safari/537.36": 8, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Mobile Safari/537.36": 27, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36 Edg/153.0.0.0": 2, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/151.0.0.0 Safari/537.36": 2, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36 Edg/151.0.0.0": 82, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Mobile Safari/537.36 EdgA/154.0.0.0": 1 }, "ua_disagreement": true } }, { "hash": "q13d0312h3_55b375c5d22e_f9238592c0a5", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Firefox \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "q13d0312h3", "b": "55b375c5d22e", "c": "f9238592c0a5", "properties": { "transport": "QUIC", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 3, "extension_count": 12, "alpn": "h3" } }, "ja3_string": "771,4865-4867-4866,65037-43-0-51-5-45-34-28-13-16-10-57,4588-29-23-24-25,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 34, "name": "34 (0x0022)", "known": false }, { "value": 28, "name": "record_size_limit", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 57, "name": "quic_transport_parameters", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [] }, "observed": { "count": 33, "first_seen": 1788446643, "last_seen": 1791217953, "transport": "q", "ja3_hash": "23855bdb1ffc9e3c79f8a56699468b1c", "ja3_variant_count": 33, "ja3_variants": [ "23855bdb1ffc9e3c79f8a56699468b1c", "e5530348ca7c982e6b026c14abc81b08", "3322a1c43ff79f72e0e83591f9b142c4", "3239a6d7a7292f6f32d554e660d3ff98", "3cc3ba852ddf609aa2ce7b724f93a4c4", "3934f9d62eb3afc9a02f33725a9abf61", "03b3dcb69cb6a762a4b032f866d8b97c", "5776261b3ce6c4c7d05f901ce62165f7", "9fadfcd58c76b1c3fc44640324a9f163", "550f1d387a5d6c5cb03d8024f1980b99", "02f140af56039b2c1e1b50aa225271e3", "b90e5cd4488326b65268435ca81470c9" ], "user_agents": { "Mozilla/5.0 (X11; Linux x86_64; rv:136.0) Gecko/20100101 Firefox/136.0": 28, "Mozilla/5.0 (X11; Linux x86_64; rv:140.0) Gecko/20100101 Firefox/140.0": 6297, "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:140.0) Gecko/20100101 Firefox/140.0": 20, "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:142.0) Gecko/20100101 Firefox/142.0": 18 }, "ua_disagreement": false } }, { "hash": "q13d0313h3_55b375c5d22e_0701f65b5a7a", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "q13d0313h3", "b": "55b375c5d22e", "c": "0701f65b5a7a", "properties": { "transport": "QUIC", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 3, "extension_count": 13, "alpn": "h3" } }, "ja3_string": "771,4865-4866-4867,0-65037-45-10-13-57-16-4832-43-17613-51-27-41,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 57, "name": "quic_transport_parameters", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 4832, "name": "4832 (0x12e0)", "known": false }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 41, "name": "pre_shared_key", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 20, "first_seen": 1788496336, "last_seen": 1788730477, "transport": "q", "ja3_hash": "5552dc60543646b205ed9930098b903d", "ja3_variant_count": 20, "ja3_variants": [ "5552dc60543646b205ed9930098b903d", "bf18c550a1f31d0f147ccf082c3d0d97", "c154966dd6792370e4f8ec1cbd522633", "d18645d7f76db942d387264436559db9", "40e701f90f97164b75eae346488a9193", "f43823ef0a39c780fc59ae55d8ec9058", "060b7156193eba8f2729eabe406247fe", "cb51343aba6e838b043cb7bc2412405a", "c278dc170ac3f23b87f08a35fb4ffc70", "02cfccbea4087b0e1d59e5199c82e231", "379f02c7b880df917cd61dcac8fc6114", "7f4e788488ebceceb2826737748d90cd" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36": 36 }, "ua_disagreement": false } }, { "hash": "q13d0313h3_55b375c5d22e_53a8b841c459", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Firefox \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "q13d0313h3", "b": "55b375c5d22e", "c": "53a8b841c459", "properties": { "transport": "QUIC", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 3, "extension_count": 13, "alpn": "h3" } }, "ja3_string": "771,4865-4867-4866,65037-0-43-57-10-34-16-28-5-27-13-51-45,4588-29-23-24-25,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 57, "name": "quic_transport_parameters", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 34, "name": "34 (0x0022)", "known": false }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 28, "name": "record_size_limit", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [] }, "observed": { "count": 46, "first_seen": 1789548605, "last_seen": 1791560800, "transport": "q", "ja3_hash": "466a0a0d1f8e14385ecfb79183387c2d", "ja3_variant_count": 46, "ja3_variants": [ "466a0a0d1f8e14385ecfb79183387c2d", "caaf461f48089932e7954d5359839ceb", "34ba67b5df7cd80f404bb77f9c8691e1", "35d99ef3383ff8bc5542a269d807e60f", "da312c87fc975208c23334465b90a4e2", "991cdf8bec72197b1f0077ec87c3ff46", "1de72ace3ce28aa146f0b6281c466b96", "540c4d110d8e79500872bec64e17b4d8", "fca334d53aafc05805c2ca735b030ab4", "773c71f372b3a4297c2f3e439fa1ae13", "f9e4f6e65485f25e82984a80ab03b3a8", "f6304c2b9c821edc22210703c8f496ff" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:156.0) Gecko/20100101 Firefox/156.0": 1132, "Mozilla/5.0 (Android 16; Mobile; rv:156.0) Gecko/156.0 Firefox/156.0": 63, "Mozilla/5.0 (Android 13; Mobile; rv:156.0) Gecko/156.0 Firefox/156.0": 139, "Mozilla/5.0 (X11; Linux x86_64; rv:156.0) Gecko/20100101 Firefox/156.0": 512, "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:156.0) Gecko/20100101 Firefox/156.0": 2663, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:156.0) Gecko/20100101 Firefox/156.0": 146 }, "ua_disagreement": false } }, { "hash": "q13d0313h3_55b375c5d22e_6ca3580cd977", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "q13d0313h3", "b": "55b375c5d22e", "c": "6ca3580cd977", "properties": { "transport": "QUIC", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 3, "extension_count": 13, "alpn": "h3" } }, "ja3_string": "771,4865-4866-4867,65037-0-13-45-51-51764-27-16-10-57-17613-43-41,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 57, "name": "quic_transport_parameters", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 41, "name": "pre_shared_key", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1307, "first_seen": 1788454681, "last_seen": 1791574655, "transport": "q", "ja3_hash": "d90dc3858eaccd11b3bac9125fd6dcc3", "ja3_variant_count": 1307, "ja3_variants": [ "d90dc3858eaccd11b3bac9125fd6dcc3", "19f22a0540953a8707fd82d507bc2a71", "8267cac4b8bcb14b0d1788f263fa4e3e", "69375e1a8d1b1c93973389836546b883", "864dde0f71c158aad32d6745a512d787", "25283a3a94402295550e631131590fae", "0c1577cc80bf21463300a20d1e9d666b", "c33a262b3671ceeed231ad49d19eaf01", "320d453dfbef14bc80c8f825063cf4b7", "424308a0d19583633b0cf89a15b23d62", "25d9cd99870cc5e6b24a14e285626a1c", "edd7c4b31aa7d7821c5f053f76051769" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 1511, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36": 1236, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 1417, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 2196, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 11245, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36": 2273, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Mobile Safari/537.36": 484, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 281, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36": 294, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 51, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 98, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Mobile Safari/537.36": 300, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36": 3, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/155.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (compatible; ev-crawler/1.0; +https://headline.com/web-crawler)": 1 }, "ua_disagreement": false } }, { "hash": "q13d0313h3_55b375c5d22e_7b1c3b3675f6", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Firefox \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "q13d0313h3", "b": "55b375c5d22e", "c": "7b1c3b3675f6", "properties": { "transport": "QUIC", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 3, "extension_count": 13, "alpn": "h3" } }, "ja3_string": "771,4865-4867-4866,65037-0-43-13-10-34-5-45-16-51-28-57-41,29-23-24-25,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 34, "name": "34 (0x0022)", "known": false }, { "value": 5, "name": "status_request", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 28, "name": "record_size_limit", "known": true }, { "value": 57, "name": "quic_transport_parameters", "known": true }, { "value": 41, "name": "pre_shared_key", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [] }, "observed": { "count": 4, "first_seen": 1791017358, "last_seen": 1791224641, "transport": "q", "ja3_hash": "f36f8df68fc24c75118a34de3a5338d2", "ja3_variant_count": 4, "ja3_variants": [ "f36f8df68fc24c75118a34de3a5338d2", "a91db7c6ad94f1040c29f115892447be", "579c3942fcd7158810ed68c7aa3e857d", "01392c383c796c97b7158cb65dfca163" ], "user_agents": { "Mozilla/5.0 (X11; Linux x86_64; rv:140.0) Gecko/20100101 Firefox/140.0": 807 }, "ua_disagreement": false } }, { "hash": "q13d0313h3_55b375c5d22e_824790d21c68", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Firefox \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "q13d0313h3", "b": "55b375c5d22e", "c": "824790d21c68", "properties": { "transport": "QUIC", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 3, "extension_count": 13, "alpn": "h3" } }, "ja3_string": "771,4865-4867-4866,65037-0-43-57-51-5-34-28-45-16-13-27-10,4588-29-23-24-25,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 57, "name": "quic_transport_parameters", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 34, "name": "34 (0x0022)", "known": false }, { "value": 28, "name": "record_size_limit", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 10, "name": "supported_groups", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [] }, "observed": { "count": 78, "first_seen": 1788441811, "last_seen": 1791567597, "transport": "q", "ja3_hash": "c670a25f1d3b13ee3db7e387d74db515", "ja3_variant_count": 78, "ja3_variants": [ "c670a25f1d3b13ee3db7e387d74db515", "0912d6898cf97ee5c479768feeea4b5d", "487c71bc132afe9c6bfc67b353d7d78e", "1ddc924e056aaa064931ba9aa7af531d", "c6ded03a42c1f9380b9561f79604bf4a", "8b89592f35c1dc2993c23fe114c39093", "cbbd2bf3afac5e7d8e45cd47dea313dc", "d199480fc989a963908de8ae131be7f5", "8f9e5eaef6acbc75e5fbc789355790e4", "167659d31bbcbe7de8403327ea440fe2", "c6717e3be4d5442d6589fde4ac8af720", "9dd5ec25481c6eaab1932a93159f40ef" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:155.0) Gecko/20100101 Firefox/155.0": 546, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:155.0) Gecko/20100101 Firefox/155.0": 310, "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:154.0) Gecko/20100101 Firefox/154.0": 23, "Mozilla/5.0 (X11; Linux x86_64; rv:155.0) Gecko/20100101 Firefox/155.0": 86, "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:153.0) Gecko/20100101 Firefox/153.0": 74, "Mozilla/5.0 (Android 14; Mobile; rv:154.0) Gecko/154.0 Firefox/154.0": 24, "Mozilla/5.0 (X11; Linux x86_64; rv:151.0) Gecko/20100101 Firefox/151.0": 33, "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:157.0) Gecko/20100101 Firefox/157.0": 371, "Mozilla/5.0 (X11; Linux x86_64; rv:153.0) Gecko/20100101 Firefox/153.0": 89, "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:154.0) Gecko/20100101 Firefox/154.0": 37, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:154.0) Gecko/20100101 Firefox/154.0": 39, "Mozilla/5.0 (Android 16; Mobile; rv:157.0) Gecko/157.0 Firefox/157.0": 83, "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:155.0) Gecko/20100101 Firefox/155.0": 38, "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:152.0) Gecko/20100101 Firefox/152.0": 51, "Mozilla/5.0 (Android 16; Mobile; rv:155.0) Gecko/155.0 Firefox/155.0": 2, "Mozilla/5.0 (X11; Linux x86_64; rv:157.0) Gecko/20100101 Firefox/157.0": 24, "Mozilla/5.0 (X11; Linux x86_64; rv:158.0) Gecko/20100101 /158.0a1": 1, "Mozilla/5.0 (X11; Linux x86_64; rv:154.0) Gecko/20100101 Firefox/154.0": 200, "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:153.0) Gecko/20100101 Firefox/153.0": 18, "Mozilla/5.0 (Android 15; Mobile; rv:154.0) Gecko/154.0 Firefox/154.0": 23, "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0": 23, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36": 28, "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:147.0) Gecko/20100101 Firefox/147.0": 28 }, "ua_disagreement": false } }, { "hash": "q13d0313h3_55b375c5d22e_b895d4c2708b", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Firefox \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "q13d0313h3", "b": "55b375c5d22e", "c": "b895d4c2708b", "properties": { "transport": "QUIC", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 3, "extension_count": 13, "alpn": "h3" } }, "ja3_string": "771,4865-4867-4866,65037-0-43-57-10-13-5-45-16-27-28-51-34,4588-29-23-24-25,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 57, "name": "quic_transport_parameters", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 28, "name": "record_size_limit", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 34, "name": "34 (0x0022)", "known": false } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [] }, "observed": { "count": 4, "first_seen": 1789400941, "last_seen": 1790017836, "transport": "q", "ja3_hash": "54844bf5884ac8adfc421690aced3612", "ja3_variant_count": 4, "ja3_variants": [ "54844bf5884ac8adfc421690aced3612", "16942382da54c033b8fc40adeb96262f", "9e0da737aef14932f1730c0013363308", "d8a66593f67258a047a3f6fb326d8d9a" ], "user_agents": { "Mozilla/5.0 (X11; Linux x86_64; rv:155.0) Gecko/20100101 Firefox/155.0": 14 }, "ua_disagreement": false } }, { "hash": "q13d0313h3_55b375c5d22e_bc972749234a", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "q13d0313h3", "b": "55b375c5d22e", "c": "bc972749234a", "properties": { "transport": "QUIC", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 3, "extension_count": 13, "alpn": "h3" } }, "ja3_string": "771,4865-4866-4867,0-17613-13-65037-4832-43-51-16-51764-10-57-45-27,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 4832, "name": "4832 (0x12e0)", "known": false }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 57, "name": "quic_transport_parameters", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 27, "name": "compress_certificate", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 77, "first_seen": 1788445297, "last_seen": 1791544874, "transport": "q", "ja3_hash": "0fd8f4d41e552aef01646805246214ed", "ja3_variant_count": 77, "ja3_variants": [ "0fd8f4d41e552aef01646805246214ed", "957366c735707a4257ed017dcacc550a", "37a30ff01c36d3cb46daebeb77c9ff26", "e8cae3c5acf6f4d6f4024d50bfb07b14", "20821c3a1071744ed9e7e36794f87934", "afa72ac574decd9ecee944237c84d10d", "9753f780fb554a7fbe0964d83703c41d", "29bf8717cc9e10ab16970d70977439c7", "17bdca27cad01ce397fbfcae0ce732b1", "cf70726dfe0a7501e25246f1e5c99141", "1e5f3e182d305b47ddf4769649b457f4", "6a6ca125b25dec1b198117f918f29bed" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 48, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 169, "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/109.0": 130, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36": 158, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/157.0.0.0 Safari/537.36": 43, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 89, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Mobile Safari/537.36": 80, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36": 93, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Mobile Safari/537.36": 46, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/151.0.0.0 Safari/537.36": 11, "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/51.0.7680.1242 Safari/537.36": 2, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36 Edg/146.0.0.0": 9, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/155.0.0.0 Safari/537.36": 3, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 104, "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/153.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.7129.1365 Safari/537.36": 9, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2159.1780 Safari/537.36": 24, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/141.0.0.0 Safari/537.36": 2 }, "ua_disagreement": true } }, { "hash": "q13d0313h3_55b375c5d22e_bea67a3397ee", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Firefox \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "q13d0313h3", "b": "55b375c5d22e", "c": "bea67a3397ee", "properties": { "transport": "QUIC", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 3, "extension_count": 13, "alpn": "h3" } }, "ja3_string": "771,4865-4867-4866,65037-43-0-57-5-28-16-34-13-27-45-10-51,4588-29-23-24-25,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 57, "name": "quic_transport_parameters", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 28, "name": "record_size_limit", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 34, "name": "34 (0x0022)", "known": false }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [] }, "observed": { "count": 4, "first_seen": 1789051688, "last_seen": 1789396785, "transport": "q", "ja3_hash": "b141832ba9c6f84a8d34b1a229c5f174", "ja3_variant_count": 4, "ja3_variants": [ "b141832ba9c6f84a8d34b1a229c5f174", "92be168b2b749bbcddaeb7789d403da6", "bc8edbb49ffe9bf28b4030f6409db086", "4a5d6609e481058da9ba363272945d26" ], "user_agents": { "Mozilla/5.0 (X11; Linux x86_64; rv:155.0) Gecko/20100101 Firefox/155.0": 131 }, "ua_disagreement": false } }, { "hash": "q13d0313h3_55b375c5d22e_e08d512f6d51", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Firefox \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "q13d0313h3", "b": "55b375c5d22e", "c": "e08d512f6d51", "properties": { "transport": "QUIC", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 3, "extension_count": 13, "alpn": "h3" } }, "ja3_string": "771,4865-4867-4866,23-28-13-16-51-34-0-5-65281-10-43-57-65037,4588-29-23-24-25,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 28, "name": "record_size_limit", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 34, "name": "34 (0x0022)", "known": false }, { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 57, "name": "quic_transport_parameters", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [] }, "observed": { "count": 20, "first_seen": 1789762404, "last_seen": 1791207819, "transport": "q", "ja3_hash": "0550a1098e4944d3fa448c2eead8bce6", "ja3_variant_count": 20, "ja3_variants": [ "0550a1098e4944d3fa448c2eead8bce6", "a0328f03f93fd2edd66c20208d1c9e56", "ae4b87166fb9aec56f302f6c652804ba", "58412b80bc0f036d724d4d74f66113b8", "4e0bbc17cd92bc2efe9dd097d6ebca96", "af98a172935c7c98cbfa3fea312c0176", "127ec8dacb40e8c419c90a670033921f", "b42c397e3bb69d33777a26af5f98226f", "d1fb7b5faa5917774d04ebcfd347fb53", "40d1e9b6128019d51970c09f2ff0932b", "80fff54b8b4950063041c661a343e5a6", "b377ded32b1df94ad7b2fb01921894d7" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:140.0) Gecko/20100101 Firefox/140.0": 36, "Mozilla/5.0 (X11; Linux x86_64; rv:140.0) Gecko/20100101 Firefox/140.0": 101 }, "ua_disagreement": false } }, { "hash": "q13d0314h3_55b375c5d22e_5e8caae252b6", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Firefox \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "q13d0314h3", "b": "55b375c5d22e", "c": "5e8caae252b6", "properties": { "transport": "QUIC", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 3, "extension_count": 14, "alpn": "h3" } }, "ja3_string": "771,4865-4867-4866,0-23-65281-10-16-5-34-51-43-13-45-28-57-65037,29-23-24-25,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 34, "name": "34 (0x0022)", "known": false }, { "value": 51, "name": "key_share", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 28, "name": "record_size_limit", "known": true }, { "value": 57, "name": "quic_transport_parameters", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [] }, "observed": { "count": 146, "first_seen": 1788446645, "last_seen": 1791141946, "transport": "q", "ja3_hash": "7a8e625dea44f20fe8d8d657583506d1", "ja3_variant_count": 144, "ja3_variants": [ "7a8e625dea44f20fe8d8d657583506d1", "e68b1cf34a2eb66bec1c9407dfdc8411", "869687a477e0a18d14cd4dcf7058c639", "48b594d894ed24f9831d6524def51415", "8400e58fd95ca6ae9affa545f08249af", "2666473eff1655280da23bcc0952624f", "b35ad7e2a6bc0573330ab443576aae34", "5e4be4be1f74253140bab4d483913c16", "5e04ce589bd590b46e27e17ecc5e6138", "507424e174e0aa3bb33756f4fb04ca75", "095c2b7004309699c6737568ba125d4e", "14176df4ac6d587003b28f217df5901b" ], "user_agents": { "Mozilla/5.0 (X11; Linux x86_64; rv:140.0) Gecko/20100101 Firefox/140.0": 3162, "Mozilla/5.0 (X11; Linux x86_64; rv:128.0) Gecko/20100101 Firefox/128.0": 4, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:140.0) Gecko/20100101 Firefox/140.0": 10 }, "ua_disagreement": false } }, { "hash": "q13d0314h3_55b375c5d22e_7dbaeef5f02a", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "q13d0314h3", "b": "55b375c5d22e", "c": "7dbaeef5f02a", "properties": { "transport": "QUIC", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 3, "extension_count": 14, "alpn": "h3" } }, "ja3_string": "771,4865-4866-4867,13-16-4832-10-43-65037-51764-17613-45-27-57-51-0-41,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 4832, "name": "4832 (0x12e0)", "known": false }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 57, "name": "quic_transport_parameters", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 41, "name": "pre_shared_key", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 14, "first_seen": 1788811477, "last_seen": 1791531335, "transport": "q", "ja3_hash": "5d0d20f646564014e75debf0db954d14", "ja3_variant_count": 14, "ja3_variants": [ "5d0d20f646564014e75debf0db954d14", "f6d3c931e8614e9858709b843b98cef4", "c663f9a007d9b871fbfe199274f2935f", "3b1ce8c435514a1053011925abe796c1", "4222021a5fb88a22590dd16ab4c964b0", "ec70efc211cbed80b6ea8a269c24808e", "3a6d7bcf30b51b87943694b72822c25d", "65e1683ac75288d08b840fa3f01d91cb", "83edae82af9e75a2356c0455051caefe", "b5dede9b5811efc4592be84d3b7c172a", "d6bbcc0328ebd96af5f7c3d75a8bcdce", "ad282db31426f0f7bafb3f3a00f79cbf" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36": 15, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 21, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 3, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 3, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/157.0.0.0 Safari/537.36": 46 }, "ua_disagreement": false } }, { "hash": "q13d0314h3_55b375c5d22e_911ef5bc091a", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Firefox \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "q13d0314h3", "b": "55b375c5d22e", "c": "911ef5bc091a", "properties": { "transport": "QUIC", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 3, "extension_count": 14, "alpn": "h3" } }, "ja3_string": "771,4865-4867-4866,0-23-65281-10-16-5-34-51-43-13-45-28-57-21,29-23-24-25-256-257-258-259-260,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 34, "name": "34 (0x0022)", "known": false }, { "value": 51, "name": "key_share", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 28, "name": "record_size_limit", "known": true }, { "value": 57, "name": "quic_transport_parameters", "known": true }, { "value": 21, "name": "padding", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true }, { "value": 258, "name": "ffdhe4096", "known": true }, { "value": 259, "name": "259 (0x0103)", "known": false }, { "value": 260, "name": "260 (0x0104)", "known": false } ], "point_formats": [] }, "observed": { "count": 6, "first_seen": 1788638690, "last_seen": 1791417846, "transport": "q", "ja3_hash": "b719940c5ab9a3373cb4475d8143ff88", "ja3_variant_count": 1, "ja3_variants": [ "b719940c5ab9a3373cb4475d8143ff88" ], "user_agents": { "Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:109.0) Gecko/20100101 Firefox/115.0": 38, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.13; rv:109.0) Gecko/20100101 Firefox/115.0": 25, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.14; rv:109.0) Gecko/20100101 Firefox/115.0": 32 }, "ua_disagreement": false } }, { "hash": "q13d0314h3_55b375c5d22e_bc0999561792", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Firefox \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "q13d0314h3", "b": "55b375c5d22e", "c": "bc0999561792", "properties": { "transport": "QUIC", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 3, "extension_count": 14, "alpn": "h3" } }, "ja3_string": "771,4865-4867-4866,65037-43-0-57-10-45-27-5-51-28-13-16-34-41,4588-29-23-24-25,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 57, "name": "quic_transport_parameters", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 28, "name": "record_size_limit", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 34, "name": "34 (0x0022)", "known": false }, { "value": 41, "name": "pre_shared_key", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [] }, "observed": { "count": 11, "first_seen": 1790603268, "last_seen": 1791516850, "transport": "q", "ja3_hash": "3ee19e68e98a26a0418d892c259c5988", "ja3_variant_count": 11, "ja3_variants": [ "3ee19e68e98a26a0418d892c259c5988", "0d0432a67eda9793a53b7042972faa80", "32ced76233b0f94eed4d0d3d765389ec", "ab53789cbee9ec976c2ba918233529d7", "18a959ed1cbb2410dbd9078f0143deb2", "d5b385c70ef24a826bcdd329848a8b4f", "5f663475441c103e3c946bca249fe6db", "d0f3eb160d465d872a933bd27a4f1994", "ef0e6fb3b2a1c96573c9bce55c8688cb", "5a430dfdd31d42c2af01b22dcabd9ccc", "f80db168ebc9e12888fe9d91509ccfad" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:156.0) Gecko/20100101 Firefox/156.0": 614, "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:156.0) Gecko/20100101 Firefox/156.0": 294, "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:156.0) Gecko/20100101 Firefox/156.0": 2077, "Mozilla/5.0 (Android 13; Mobile; rv:156.0) Gecko/156.0 Firefox/156.0": 15 }, "ua_disagreement": false } }, { "hash": "q13d0314h3_55b375c5d22e_e4435efaeef9", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Firefox \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "q13d0314h3", "b": "55b375c5d22e", "c": "e4435efaeef9", "properties": { "transport": "QUIC", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 3, "extension_count": 14, "alpn": "h3" } }, "ja3_string": "771,4865-4867-4866,65037-43-0-57-34-16-10-27-28-51-45-5-13-41,4588-29-23-24-25,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 57, "name": "quic_transport_parameters", "known": true }, { "value": 34, "name": "34 (0x0022)", "known": false }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 28, "name": "record_size_limit", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 41, "name": "pre_shared_key", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [] }, "observed": { "count": 2, "first_seen": 1790867871, "last_seen": 1791285277, "transport": "q", "ja3_hash": "1d3fd2ff4d4775e9cdaf3a96627946c4", "ja3_variant_count": 2, "ja3_variants": [ "1d3fd2ff4d4775e9cdaf3a96627946c4", "7240a7bef8f9f6ccf741be05fe8ba833" ], "user_agents": { "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:153.0) Gecko/20100101 Firefox/153.0": 2, "Mozilla/5.0 (X11; Linux x86_64; rv:155.0) Gecko/20100101 Firefox/155.0": 3 }, "ua_disagreement": false } }, { "hash": "q13d0315h3_55b375c5d22e_2473069875c4", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Firefox \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "q13d0315h3", "b": "55b375c5d22e", "c": "2473069875c4", "properties": { "transport": "QUIC", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 3, "extension_count": 15, "alpn": "h3" } }, "ja3_string": "771,4865-4867-4866,34-65281-28-10-0-23-45-27-43-51-5-13-16-57-65037,4588-29-23-24-25,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true } ], "extensions": [ { "value": 34, "name": "34 (0x0022)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 28, "name": "record_size_limit", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 57, "name": "quic_transport_parameters", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [] }, "observed": { "count": 271, "first_seen": 1788441810, "last_seen": 1791559063, "transport": "q", "ja3_hash": "4116fa881abec9e8e77cbbba19990d43", "ja3_variant_count": 271, "ja3_variants": [ "4116fa881abec9e8e77cbbba19990d43", "061deed5b0410423c4e4f846d2a50739", "a917a0de0000ca1a8da3c01f11a3e9a3", "c09972b0251b0e77a070524b9fa29492", "a783a466153806a481d5348ed39bc156", "8ce1a2ed7f3b5470e6ec12e62095a479", "bc4547924d8080cf235cf105d09cb2da", "77e7e842205b409ac9d7e012040b5203", "f8577abd1c25ae377b334d3f24fbc266", "f9451a72b39a916acbf23a73c35b5327", "c212f4efece1422bb6376007d80c8c9a", "320dced1977aefbd635a463ba1096d4d" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:154.0) Gecko/20100101 Firefox/154.0": 161, "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:153.0) Gecko/20100101 Firefox/153.0": 136, "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:155.0) Gecko/20100101 Firefox/155.0": 80, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:155.0) Gecko/20100101 Firefox/155.0": 123, "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:155.0) Gecko/20100101 Firefox/155.0": 653, "Mozilla/5.0 (Android 16; Mobile; rv:157.0) Gecko/157.0 Firefox/157.0": 65, "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:157.0) Gecko/20100101 Firefox/157.0": 379, "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:149.0) Gecko/20100101 Firefox/149.0": 495, "Mozilla/5.0 (Android 17; Mobile; rv:155.0) Gecko/155.0 Firefox/155.0": 19, "Mozilla/5.0 (X11; Linux x86_64; rv:154.0) Gecko/20100101 Firefox/154.0": 240, "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0": 5, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36": 5, "Mozilla/5.0 (X11; Linux x86_64; rv:153.0) Gecko/20100101 Firefox/153.0": 4, "Mozilla/5.0 (Android 16; Mobile; rv:155.0) Gecko/155.0 Firefox/155.0": 1, "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:153.0) Gecko/20100101 Firefox/153.0": 1170, "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:154.0) Gecko/20100101 Firefox/154.0": 109, "Mozilla/5.0 (Android 14; Mobile; rv:154.0) Gecko/154.0 Firefox/154.0": 7, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:157.0) Gecko/20100101 Firefox/157.0": 3, "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:151.0) Gecko/20100101 Firefox/151.0": 45, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:154.0) Gecko/20100101 Firefox/154.0": 19, "Mozilla/5.0 (X11; Linux x86_64; rv:157.0) Gecko/20100101 Firefox/157.0": 2, "Mozilla/5.0 (X11; Linux x86_64; rv:151.0) Gecko/20100101 Firefox/151.0": 14, "Mozilla/5.0 (Android 15; Mobile; rv:154.0) Gecko/154.0 Firefox/154.0": 2 }, "ua_disagreement": false } }, { "hash": "q13d0315h3_55b375c5d22e_626768ae0108", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Firefox \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "q13d0315h3", "b": "55b375c5d22e", "c": "626768ae0108", "properties": { "transport": "QUIC", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 3, "extension_count": 15, "alpn": "h3" } }, "ja3_string": "771,4865-4867-4866,10-23-5-34-45-28-0-16-65281-13-43-51-27-57-65037,4588-29-23-24-25,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 34, "name": "34 (0x0022)", "known": false }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 28, "name": "record_size_limit", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 57, "name": "quic_transport_parameters", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [] }, "observed": { "count": 663, "first_seen": 1788556928, "last_seen": 1791449777, "transport": "q", "ja3_hash": "dd3d64579af7df0731da46d041518947", "ja3_variant_count": 663, "ja3_variants": [ "dd3d64579af7df0731da46d041518947", "2af1fb8d7123c5ad947bf12ea7ceb5c7", "72571dc079cf541ef224ed0beea4bfbd", "9f0bc0fa5add68c2d15e0df01f2cd104", "bfe87ad9647046609b911f0ce14c872b", "48d7abd0475e2c766fea94f0078f1983", "65e44ab85412401fe9ba4570f3b9b7d5", "e7cb38150a0130c0c697409cacc89762", "5930c8bd24912286b0f4e06f62086ce8", "d090f0deb649aaff0fd099e465d468f5", "5fe2b7d9ff725c78c1ebeae54adc14f7", "1d45c72c8960fe60331ae6f2ea97dfc1" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:156.0) Gecko/20100101 Firefox/156.0": 2028, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:156.0) Gecko/20100101 Firefox/156.0": 78, "Mozilla/5.0 (X11; Linux x86_64; rv:155.0) Gecko/20100101 Firefox/155.0": 8, "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:156.0) Gecko/20100101 Firefox/156.0": 1080, "Mozilla/5.0 (X11; Linux x86_64; rv:156.0) Gecko/20100101 Firefox/156.0": 459, "Mozilla/5.0 (X11; Linux x86_64; rv:157.0) Gecko/20100101 Firefox/157.0": 70, "Mozilla/5.0 (Android 13; Mobile; rv:156.0) Gecko/156.0 Firefox/156.0": 13, "Mozilla/5.0 (Android 16; Mobile; rv:156.0) Gecko/156.0 Firefox/156.0": 118, "Mozilla/5.0 (Android 14; Mobile; rv:156.0) Gecko/156.0 Firefox/156.0": 2 }, "ua_disagreement": false } }, { "hash": "q13d0315h3_55b375c5d22e_6af405fcf435", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Firefox \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "q13d0315h3", "b": "55b375c5d22e", "c": "6af405fcf435", "properties": { "transport": "QUIC", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 3, "extension_count": 15, "alpn": "h3" } }, "ja3_string": "771,4865-4867-4866,28-5-13-65281-27-43-51-16-34-23-10-45-0-57-65037,4588-29-23-24-25,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true } ], "extensions": [ { "value": 28, "name": "record_size_limit", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 34, "name": "34 (0x0022)", "known": false }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 57, "name": "quic_transport_parameters", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [] }, "observed": { "count": 93, "first_seen": 1789051693, "last_seen": 1789399139, "transport": "q", "ja3_hash": "1eff7898218924c65d38f8f7e32869da", "ja3_variant_count": 93, "ja3_variants": [ "1eff7898218924c65d38f8f7e32869da", "2cfcc47571a482e88b42cfc4f6b423a2", "e97cae745e14ce02126e1109dcaa69e3", "e14815e55b3e402f238b5e529bcb5997", "e91c8015c6def89b7b0fb9c6da7dd9d0", "6e8c85a95f2ecbd9c5b92bb4fa3c7125", "d7ac6e2a61f9f9fd8123d13eb8ea7f0c", "380339c033eafd2a0a67cadbf042107d", "4d2faa3ef3a5b524750fda9985d37972", "f4d51d0922eb47a718b1be989084f3d5", "f49f26fb6cc16644ae584d57576ae5e5", "5c5e7fd1619c02303734abf27f462022" ], "user_agents": { "Mozilla/5.0 (X11; Linux x86_64; rv:155.0) Gecko/20100101 Firefox/155.0": 133 }, "ua_disagreement": false } }, { "hash": "q13d0315h3_55b375c5d22e_725e25c74efd", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Firefox \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "q13d0315h3", "b": "55b375c5d22e", "c": "725e25c74efd", "properties": { "transport": "QUIC", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 3, "extension_count": 15, "alpn": "h3" } }, "ja3_string": "771,4865-4867-4866,13-23-16-65281-34-43-10-45-28-27-51-5-0-57-65037,4588-29-23-24-25,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 34, "name": "34 (0x0022)", "known": false }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 28, "name": "record_size_limit", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 57, "name": "quic_transport_parameters", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [] }, "observed": { "count": 2, "first_seen": 1789472422, "last_seen": 1789652355, "transport": "q", "ja3_hash": "8b52796f45070fc15ab3952715a513bc", "ja3_variant_count": 2, "ja3_variants": [ "8b52796f45070fc15ab3952715a513bc", "af4243cffdd3f4cade734ab99dda1439" ], "user_agents": { "Mozilla/5.0 (X11; Linux x86_64; rv:155.0) Gecko/20100101 Firefox/155.0": 8 }, "ua_disagreement": false } }, { "hash": "q13d0316h3_55b375c5d22e_1c63e1c09786", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Firefox \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "q13d0316h3", "b": "55b375c5d22e", "c": "1c63e1c09786", "properties": { "transport": "QUIC", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 3, "extension_count": 16, "alpn": "h3" } }, "ja3_string": "771,4865-4867-4866,28-23-0-51-65281-16-5-34-10-43-45-27-13-57-65037-41,4588-29-23-24-25,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true } ], "extensions": [ { "value": 28, "name": "record_size_limit", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 34, "name": "34 (0x0022)", "known": false }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 57, "name": "quic_transport_parameters", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 41, "name": "pre_shared_key", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791002546, "last_seen": 1791002546, "transport": "q", "ja3_hash": "0562f80ef0d308c251ae29af37f1f727", "ja3_variant_count": 1, "ja3_variants": [ "0562f80ef0d308c251ae29af37f1f727" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:157.0) Gecko/20100101 Firefox/157.0": 9 }, "ua_disagreement": false } }, { "hash": "q13d0316h3_55b375c5d22e_67ff8e38dd8c", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Firefox \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "q13d0316h3", "b": "55b375c5d22e", "c": "67ff8e38dd8c", "properties": { "transport": "QUIC", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 3, "extension_count": 16, "alpn": "h3" } }, "ja3_string": "771,4865-4867-4866,27-10-16-13-45-5-43-34-51-23-65281-28-0-57-65037-41,4588-29-23-24-25,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 34, "name": "34 (0x0022)", "known": false }, { "value": 51, "name": "key_share", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 28, "name": "record_size_limit", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 57, "name": "quic_transport_parameters", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 41, "name": "pre_shared_key", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [] }, "observed": { "count": 4, "first_seen": 1790602532, "last_seen": 1790623455, "transport": "q", "ja3_hash": "d20dedc8f49a6ff5ea0765a490558bf3", "ja3_variant_count": 4, "ja3_variants": [ "d20dedc8f49a6ff5ea0765a490558bf3", "b68c365c7bca9c980a9d65d158ec6194", "492ac74f50c8c0b9f659ce045b189836", "4747cceba11bbea78a15091b9e91fec8" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:156.0) Gecko/20100101 Firefox/156.0": 126, "Mozilla/5.0 (Android 13; Mobile; rv:156.0) Gecko/156.0 Firefox/156.0": 1 }, "ua_disagreement": false } }, { "hash": "q13d0413h3_16476d049b0b_745ab6f97f32", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "q13d0413h3", "b": "16476d049b0b", "c": "745ab6f97f32", "properties": { "transport": "QUIC", "tls_version": "TLS 1.3", "sni": "server name sent", "cipher_count": 4, "extension_count": 13, "alpn": "h3" } }, "ja3_string": "771,4866-4867-4865-255,0-11-10-16-22-23-49-13-43-45-51-57-21,29-23-30-25-24-256-257-258-259-260,0-1-2", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 255, "name": "TLS_EMPTY_RENEGOTIATION_INFO_SCSV", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 22, "name": "encrypt_then_mac", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 49, "name": "post_handshake_auth", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 43, "name": "supported_versions", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 57, "name": "quic_transport_parameters", "known": true }, { "value": 21, "name": "padding", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 30, "name": "x448", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true }, { "value": 258, "name": "ffdhe4096", "known": true }, { "value": 259, "name": "259 (0x0103)", "known": false }, { "value": 260, "name": "260 (0x0104)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true }, { "value": 1, "name": "ansiX962_compressed_prime", "known": true }, { "value": 2, "name": "ansiX962_compressed_char2", "known": true } ] }, "observed": { "count": 4660, "first_seen": 1787442710, "last_seen": 1791576427, "transport": "q", "ja3_hash": "42125b8d3d7a27886a9600b9a38e8559", "ja3_variant_count": 3, "ja3_variants": [ "42125b8d3d7a27886a9600b9a38e8559", "3fdff4d24f9789bafa145c6e30e8031d", "e8eac859d9939ad67c1b133a9ba103c0" ], "user_agents": { "curl/8.18.0-DEV": 170, "Go-http-client/2.0": 3, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36": 4162 }, "ua_disagreement": true } }, { "hash": "t12d0309h2_55b375c5d22e_4234f4f8d875", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Firefox \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d0309h2", "b": "55b375c5d22e", "c": "4234f4f8d875", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 3, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,4865-4867-4866,0-23-65281-10-16-5-34-18-51,4588-29-23-24-25-256-257,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 34, "name": "34 (0x0022)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true } ], "point_formats": [] }, "observed": { "count": 18, "first_seen": 1790842589, "last_seen": 1790842595, "transport": "t", "ja3_hash": "22f55bb0bd09950a3cbbf22292800da0", "ja3_variant_count": 1, "ja3_variants": [ "22f55bb0bd09950a3cbbf22292800da0" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:140.0) Gecko/20100101 Firefox/140.0": 38 }, "ua_disagreement": false } }, { "hash": "t12d130200_f57a46bbacb6_e756749613b3", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Firefox \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d130200", "b": "f57a46bbacb6", "c": "e756749613b3", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 13, "extension_count": 2, "alpn": null } }, "ja3_string": "771,52393-52392-49195-49199-49196-49200-49161-49171-49162-49172-4867-4865-4866,0-11,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790628399, "last_seen": 1790628399, "transport": "t", "ja3_hash": "e2cbd84848ec221c6d8f1e665fec21e5", "ja3_variant_count": 1, "ja3_variants": [ "e2cbd84848ec221c6d8f1e665fec21e5" ], "user_agents": { "Mozilla/5.0 (X11; Linux x86_64; rv:123.0) Gecko/20100101 Firefox/123.0": 1 }, "ua_disagreement": false } }, { "hash": "t12d130800_f57a46bbacb6_da269a3f638a", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d130800", "b": "f57a46bbacb6", "c": "da269a3f638a", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 13, "extension_count": 8, "alpn": null } }, "ja3_string": "771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-4865-4866-4867,0-11-65281-23-18-5-10-13,4588-4587-4589-29-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 4587, "name": "X25519MLKEM768", "known": true }, { "value": 4589, "name": "4589 (0x11ed)", "known": false }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 27, "first_seen": 1787471559, "last_seen": 1790966583, "transport": "t", "ja3_hash": "d8f17d41fba1d5b9f88fff3a2bf0df6c", "ja3_variant_count": 1, "ja3_variants": [ "d8f17d41fba1d5b9f88fff3a2bf0df6c" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.6111.87 Safari/537.36": 1, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.5690.62 Safari/537.36": 1, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/155.0.5599.130 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d1310h2_8b80da21ef18_6c199d4894a3", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Seen in live traffic; not in the curated database.", "ja4": { "a": "t12d1310h2", "b": "8b80da21ef18", "c": "6c199d4894a3", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 13, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53-10,65281-0-23-35-13-5-18-16-11-10,29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 63, "first_seen": 1787772520, "last_seen": 1791511372, "transport": "t", "ja3_hash": "bc6c386f480ee97b9d9e52d472b772d8", "ja3_variant_count": 1, "ja3_variants": [ "bc6c386f480ee97b9d9e52d472b772d8" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d1310h2_f57a46bbacb6_fdfedcf8c354", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1310h2", "b": "f57a46bbacb6", "c": "fdfedcf8c354", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 13, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4866-4867-4865-49196-49200-49195-52393-49199-52392-49162-49161-49172-49171,0-23-65281-10-11-16-5-13-18-51,4588-29-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 4, "first_seen": 1789355901, "last_seen": 1790068317, "transport": "t", "ja3_hash": "ebd040121a56b6c06b9f24a33d45434f", "ja3_variant_count": 2, "ja3_variants": [ "ebd040121a56b6c06b9f24a33d45434f", "9223f20a70d5753741a78e5b06e9648c" ], "user_agents": { "DeepSeek Chat/2.5.2 (com.deepseek.chat; build:7; iOS 27.2.0) Alamofire/5.10.2": 1, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit/601.2.4 (KHTML, like Gecko) Version/9.0.1 Safari/601.2.4 facebookexternalhit/1.1 Facebot Twitterbot/1.0": 2 }, "ua_disagreement": false } }, { "hash": "t12d1311h2_8b80da21ef18_bc4a777cfdc5", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Seen in live traffic; not in the curated database.", "ja4": { "a": "t12d1311h2", "b": "8b80da21ef18", "c": "bc4a777cfdc5", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 13, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53-10,65281-0-23-35-13-5-18-16-30032-11-10,29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 30032, "name": "30032 (0x7550)", "known": false }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 4, "first_seen": 1789405266, "last_seen": 1790181002, "transport": "t", "ja3_hash": "94c485bca29d5392be53f2b8cf7f4304", "ja3_variant_count": 1, "ja3_variants": [ "94c485bca29d5392be53f2b8cf7f4304" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d150200_8daaf6152771_1b12d417929b", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150200", "b": "8daaf6152771", "c": "1b12d417929b", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 2, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 15, "first_seen": 1788147667, "last_seen": 1791299123, "transport": "t", "ja3_hash": "ce3c89f378314f9ab654c09f0b60df1e", "ja3_variant_count": 1, "ja3_variants": [ "ce3c89f378314f9ab654c09f0b60df1e" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36": 2, "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 2, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36": 2 }, "ua_disagreement": false } }, { "hash": "t12d150300_8daaf6152771_1037bdebdd62", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150300", "b": "8daaf6152771", "c": "1037bdebdd62", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 3, "alpn": null } }, "ja3_string": "771,4867-4865-4866-52393-52392-49195-49199-49196-49200-49171-49172-156-157-47-53,51-0-65037,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 3, "first_seen": 1788620848, "last_seen": 1790223254, "transport": "t", "ja3_hash": "ed36d5b86808bab06feb806f040bfe21", "ja3_variant_count": 3, "ja3_variants": [ "ed36d5b86808bab06feb806f040bfe21", "436a49d8bffc70281ec2f871088227a0", "ba422d220df57d21232e88ed18a71df0" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12d150300_8daaf6152771_27e267d15e11", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150300", "b": "8daaf6152771", "c": "27e267d15e11", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 3, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-5-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 3, "first_seen": 1788836144, "last_seen": 1791020225, "transport": "t", "ja3_hash": "f66da1a354d437f56843f5892eddc4e3", "ja3_variant_count": 2, "ja3_variants": [ "f66da1a354d437f56843f5892eddc4e3", "1b4ae136bf5dda8ede24a09db9f07c95" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12d150300_8daaf6152771_2968ded16f02", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150300", "b": "8daaf6152771", "c": "2968ded16f02", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 3, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-0-27,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 27, "name": "compress_certificate", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 2, "first_seen": 1788780981, "last_seen": 1790201324, "transport": "t", "ja3_hash": "0a2c9c111fd3419a7e16fe442a72a745", "ja3_variant_count": 2, "ja3_variants": [ "0a2c9c111fd3419a7e16fe442a72a745", "c0b2779eb8abfe8680a2fa2a6282eb93" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12d150300_8daaf6152771_a537042d8382", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150300", "b": "8daaf6152771", "c": "a537042d8382", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 3, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-0-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 3, "first_seen": 1790214339, "last_seen": 1790563270, "transport": "t", "ja3_hash": "9525b2e52df363abd83e20b46ae533bb", "ja3_variant_count": 3, "ja3_variants": [ "9525b2e52df363abd83e20b46ae533bb", "dee8f5b5ddd86c6247fccb40ece1568b", "362843bea6640eea3d36b268def4fc3c" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d150300_8daaf6152771_baf0a4827efd", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150300", "b": "8daaf6152771", "c": "baf0a4827efd", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 3, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-51-16,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788965186, "last_seen": 1788965186, "transport": "t", "ja3_hash": "2764fcba8d3ecd74cc33de5ee5e3af0e", "ja3_variant_count": 1, "ja3_variants": [ "2764fcba8d3ecd74cc33de5ee5e3af0e" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12d150300_8daaf6152771_c988acfa4f19", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150300", "b": "8daaf6152771", "c": "c988acfa4f19", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 3, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-18-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 4, "first_seen": 1789646813, "last_seen": 1790699605, "transport": "t", "ja3_hash": "50f106f4a102447a2efa16bfbd8a8020", "ja3_variant_count": 2, "ja3_variants": [ "50f106f4a102447a2efa16bfbd8a8020", "6828d4d0938451ac917a74cafc1783aa" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36": 6, "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; https://zhanzhang.toutiao.com/)": 3, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d150300_8daaf6152771_cb0c27a6e9f0", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150300", "b": "8daaf6152771", "c": "cb0c27a6e9f0", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 3, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-0-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 2, "first_seen": 1789829293, "last_seen": 1791247952, "transport": "t", "ja3_hash": "b8a7dbf836dd5abfd314c15d4023e35d", "ja3_variant_count": 2, "ja3_variants": [ "b8a7dbf836dd5abfd314c15d4023e35d", "5d1c020f6a474330da91583569e71fc1" ], "user_agents": { "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Mobile Safari/537.36": 14, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36": 4 }, "ua_disagreement": false } }, { "hash": "t12d150300_8daaf6152771_d50387acfe72", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150300", "b": "8daaf6152771", "c": "d50387acfe72", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 3, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-0-17613,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790188469, "last_seen": 1790188469, "transport": "t", "ja3_hash": "abb4b79fac099c3e5f3fc2def5553885", "ja3_variant_count": 1, "ja3_variants": [ "abb4b79fac099c3e5f3fc2def5553885" ], "user_agents": { "Mozilla/5.0 (Windows NT 6.2; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3456.23 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d150300_8daaf6152771_ef9d29fa14b0", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150300", "b": "8daaf6152771", "c": "ef9d29fa14b0", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 3, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-23-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 5, "first_seen": 1787827864, "last_seen": 1791285261, "transport": "t", "ja3_hash": "64649f6616902001c5ac6b8b9f3cba14", "ja3_variant_count": 2, "ja3_variants": [ "64649f6616902001c5ac6b8b9f3cba14", "b60e990260b58b75280a622a3e6196b5" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 9, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/146.0.7680.165 Safari/537.36": 1 }, "ua_disagreement": true } }, { "hash": "t12d1503h1_8daaf6152771_baf0a4827efd", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1503h1", "b": "8daaf6152771", "c": "baf0a4827efd", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 3, "alpn": "h1" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-0-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790978174, "last_seen": 1790978174, "transport": "t", "ja3_hash": "e76751cdff2796470a1e821ba73864d9", "ja3_variant_count": 1, "ja3_variants": [ "e76751cdff2796470a1e821ba73864d9" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d1503h2_8daaf6152771_baf0a4827efd", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Shares its JA4_c (baf0a4827efd) with 4 fingerprints classified as browser, and nothing else in that family disagrees \u2014 the same tool under different cipher options. Inferred from the family, not observed directly.", "ja4": { "a": "t12d1503h2", "b": "8daaf6152771", "c": "baf0a4827efd", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 3, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-16-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788552171, "last_seen": 1788552171, "transport": "t", "ja3_hash": "bd8ab30ac2691412f699cecb6a9b15ac", "ja3_variant_count": 1, "ja3_variants": [ "bd8ab30ac2691412f699cecb6a9b15ac" ], "user_agents": [], "ua_disagreement": false }, "inferred_from_family": true }, { "hash": "t12d150400_8daaf6152771_01b6db3acd9a", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150400", "b": "8daaf6152771", "c": "01b6db3acd9a", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-0-5-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 2, "first_seen": 1790561712, "last_seen": 1791215865, "transport": "t", "ja3_hash": "90fbe91afeb9b0ed1fe551bd88ca30cf", "ja3_variant_count": 1, "ja3_variants": [ "90fbe91afeb9b0ed1fe551bd88ca30cf" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 15, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d150400_8daaf6152771_088cf4770d0f", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150400", "b": "8daaf6152771", "c": "088cf4770d0f", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-65281-0-65037,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790227777, "last_seen": 1790227777, "transport": "t", "ja3_hash": "9ebac4f608d199fcb169d3b7823c28dc", "ja3_variant_count": 1, "ja3_variants": [ "9ebac4f608d199fcb169d3b7823c28dc" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d150400_8daaf6152771_08f4e96ed339", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150400", "b": "8daaf6152771", "c": "08f4e96ed339", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-65281-0-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 2, "first_seen": 1790212854, "last_seen": 1791149171, "transport": "t", "ja3_hash": "802d342e67755d73b926b7ff720a4de2", "ja3_variant_count": 2, "ja3_variants": [ "802d342e67755d73b926b7ff720a4de2", "55c5ce86b56636a6f48c29c441310a5a" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 2 }, "ua_disagreement": false } }, { "hash": "t12d150400_8daaf6152771_11f55bce4215", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150400", "b": "8daaf6152771", "c": "11f55bce4215", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-0-13-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790615495, "last_seen": 1790615495, "transport": "t", "ja3_hash": "372d40dcbb20cd8478e4cb959e9c406f", "ja3_variant_count": 1, "ja3_variants": [ "372d40dcbb20cd8478e4cb959e9c406f" ], "user_agents": { "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 24 }, "ua_disagreement": false } }, { "hash": "t12d150400_8daaf6152771_1afacb3113b9", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150400", "b": "8daaf6152771", "c": "1afacb3113b9", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-27-17613-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789776179, "last_seen": 1789776179, "transport": "t", "ja3_hash": "d604dc4f0e3ff9eaa09df2506c3382e9", "ja3_variant_count": 1, "ja3_variants": [ "d604dc4f0e3ff9eaa09df2506c3382e9" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36 Edg/135.0.0.0": 3 }, "ua_disagreement": false } }, { "hash": "t12d150400_8daaf6152771_21d4e6433b0e", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150400", "b": "8daaf6152771", "c": "21d4e6433b0e", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-0-13-5,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 5, "name": "status_request", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790029248, "last_seen": 1790029248, "transport": "t", "ja3_hash": "a91169ce2b8480074e25e2e4d8569001", "ja3_variant_count": 1, "ja3_variants": [ "a91169ce2b8480074e25e2e4d8569001" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d150400_8daaf6152771_24be3a94643d", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150400", "b": "8daaf6152771", "c": "24be3a94643d", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-0-11-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 2, "first_seen": 1788824791, "last_seen": 1790236572, "transport": "t", "ja3_hash": "888c634bb1c0b4f0306013f510d7e277", "ja3_variant_count": 2, "ja3_variants": [ "888c634bb1c0b4f0306013f510d7e277", "bd96bc091e480c41ed05813f08208da3" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 2 }, "ua_disagreement": false } }, { "hash": "t12d150400_8daaf6152771_2d266b4c4422", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150400", "b": "8daaf6152771", "c": "2d266b4c4422", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-27-10-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 2, "first_seen": 1788788504, "last_seen": 1791275508, "transport": "t", "ja3_hash": "17907122c2db39607f33038ee89c12bc", "ja3_variant_count": 2, "ja3_variants": [ "17907122c2db39607f33038ee89c12bc", "f7761981a5691fa13a81fb416dfa4cef" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12d150400_8daaf6152771_45d94bed0bc4", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150400", "b": "8daaf6152771", "c": "45d94bed0bc4", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-0-65037-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790029172, "last_seen": 1790029172, "transport": "t", "ja3_hash": "2a7e5be1860ec9810164848c89303e20", "ja3_variant_count": 1, "ja3_variants": [ "2a7e5be1860ec9810164848c89303e20" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 8 }, "ua_disagreement": false } }, { "hash": "t12d150400_8daaf6152771_497e282bcdb3", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150400", "b": "8daaf6152771", "c": "497e282bcdb3", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-0-45-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 3, "first_seen": 1788380816, "last_seen": 1791135129, "transport": "t", "ja3_hash": "32c3a4cbf210de5419fa47d999960100", "ja3_variant_count": 1, "ja3_variants": [ "32c3a4cbf210de5419fa47d999960100" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d150400_8daaf6152771_55a0f8a19a8e", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150400", "b": "8daaf6152771", "c": "55a0f8a19a8e", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-0-65037-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 3, "first_seen": 1788791349, "last_seen": 1791013028, "transport": "t", "ja3_hash": "a734d22871183ae97839df0eb98a710f", "ja3_variant_count": 3, "ja3_variants": [ "a734d22871183ae97839df0eb98a710f", "6c20163d091dfb5fd4cc24825332725f", "c4d6d08d075f88f3660a815691bbf144" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12d150400_8daaf6152771_5607da189e96", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150400", "b": "8daaf6152771", "c": "5607da189e96", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-13-0-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789224351, "last_seen": 1789224351, "transport": "t", "ja3_hash": "1d7ed160de91d8ea379f670d89b63ed5", "ja3_variant_count": 1, "ja3_variants": [ "1d7ed160de91d8ea379f670d89b63ed5" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d150400_8daaf6152771_5643bfcee586", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150400", "b": "8daaf6152771", "c": "5643bfcee586", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-35-45-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790702244, "last_seen": 1790702244, "transport": "t", "ja3_hash": "36fa034a5c3df0267597f2b617004d57", "ja3_variant_count": 1, "ja3_variants": [ "36fa034a5c3df0267597f2b617004d57" ], "user_agents": { "Mozilla/5.0 (Linux; Android 15; Pixel 9) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Mobile Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d150400_8daaf6152771_572e9f68f086", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150400", "b": "8daaf6152771", "c": "572e9f68f086", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-0-23-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790313417, "last_seen": 1790313417, "transport": "t", "ja3_hash": "c38247d4910bb0bb74acef3b1b62cc34", "ja3_variant_count": 1, "ja3_variants": [ "c38247d4910bb0bb74acef3b1b62cc34" ], "user_agents": { "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 15, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Mobile Safari/537.36": 2 }, "ua_disagreement": false } }, { "hash": "t12d150400_8daaf6152771_5e7d57c5c4e2", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150400", "b": "8daaf6152771", "c": "5e7d57c5c4e2", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-0-51-51764,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790361980, "last_seen": 1790361980, "transport": "t", "ja3_hash": "bcd263185dbef358c1091f24b75a3f9e", "ja3_variant_count": 1, "ja3_variants": [ "bcd263185dbef358c1091f24b75a3f9e" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 9 }, "ua_disagreement": false } }, { "hash": "t12d150400_8daaf6152771_6228070e188e", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150400", "b": "8daaf6152771", "c": "6228070e188e", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-10-0-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 2, "first_seen": 1789870180, "last_seen": 1791032231, "transport": "t", "ja3_hash": "632b789e10d0256f10ad45c71d2e97f3", "ja3_variant_count": 2, "ja3_variants": [ "632b789e10d0256f10ad45c71d2e97f3", "76f92d429e51b946f61357e697d0a4da" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36": 2 }, "ua_disagreement": false } }, { "hash": "t12d150400_8daaf6152771_644b8bc94a83", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150400", "b": "8daaf6152771", "c": "644b8bc94a83", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-0-10-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 2, "first_seen": 1790222306, "last_seen": 1791284954, "transport": "t", "ja3_hash": "0ffc54f0cd919d8f4ae16677dd970b29", "ja3_variant_count": 2, "ja3_variants": [ "0ffc54f0cd919d8f4ae16677dd970b29", "d80318171f6fbd27dfd2d58b8751e448" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36": 2 }, "ua_disagreement": false } }, { "hash": "t12d150400_8daaf6152771_762b5886a455", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Shares its JA4_c (762b5886a455) with 1 fingerprint classified as browser, and nothing else in that family disagrees \u2014 the same tool under different cipher options. Inferred from the family, not observed directly.", "ja4": { "a": "t12d150400", "b": "8daaf6152771", "c": "762b5886a455", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-65281-5-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 2, "first_seen": 1790230737, "last_seen": 1791123321, "transport": "t", "ja3_hash": "560e9c785abc7b3f2a870600a2e3c6b3", "ja3_variant_count": 2, "ja3_variants": [ "560e9c785abc7b3f2a870600a2e3c6b3", "509c538880fd49ee9ba25614b51a1dc5" ], "user_agents": [], "ua_disagreement": false }, "inferred_from_family": true }, { "hash": "t12d150400_8daaf6152771_7ecc11558ac0", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150400", "b": "8daaf6152771", "c": "7ecc11558ac0", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-51-0-13,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791085754, "last_seen": 1791085754, "transport": "t", "ja3_hash": "66bde0b2e10f0a7d7551d2606451e770", "ja3_variant_count": 1, "ja3_variants": [ "66bde0b2e10f0a7d7551d2606451e770" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 10 }, "ua_disagreement": false } }, { "hash": "t12d150400_8daaf6152771_81de017437bc", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150400", "b": "8daaf6152771", "c": "81de017437bc", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-17613-51-65037,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791235596, "last_seen": 1791235596, "transport": "t", "ja3_hash": "e3865414573a877ce772994ff5a86e89", "ja3_variant_count": 1, "ja3_variants": [ "e3865414573a877ce772994ff5a86e89" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36": 9 }, "ua_disagreement": false } }, { "hash": "t12d150400_8daaf6152771_89ce44e3989a", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150400", "b": "8daaf6152771", "c": "89ce44e3989a", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-27-35-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790243780, "last_seen": 1790243780, "transport": "t", "ja3_hash": "a157ccdc82069889bbfbab5016a811a3", "ja3_variant_count": 1, "ja3_variants": [ "a157ccdc82069889bbfbab5016a811a3" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d150400_8daaf6152771_9f1d7398a82c", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150400", "b": "8daaf6152771", "c": "9f1d7398a82c", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-0-23-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788763478, "last_seen": 1788763478, "transport": "t", "ja3_hash": "8d66bb52100efc87be8494a7ff952da4", "ja3_variant_count": 1, "ja3_variants": [ "8d66bb52100efc87be8494a7ff952da4" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12d150400_8daaf6152771_ae39024d9ed9", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150400", "b": "8daaf6152771", "c": "ae39024d9ed9", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-0-18-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790539206, "last_seen": 1790539206, "transport": "t", "ja3_hash": "e68ffe2fc5012446b0a58d2d25c51d50", "ja3_variant_count": 1, "ja3_variants": [ "e68ffe2fc5012446b0a58d2d25c51d50" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d150400_8daaf6152771_b393474956ce", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150400", "b": "8daaf6152771", "c": "b393474956ce", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-45-27-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788973909, "last_seen": 1788973909, "transport": "t", "ja3_hash": "47636259c8e34a1451d78b583d633d85", "ja3_variant_count": 1, "ja3_variants": [ "47636259c8e34a1451d78b583d633d85" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12d150400_8daaf6152771_b5c8f20dbb54", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150400", "b": "8daaf6152771", "c": "b5c8f20dbb54", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-0-11-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790241024, "last_seen": 1790241024, "transport": "t", "ja3_hash": "49f6a1e16209aa18f85b942e79cde4bc", "ja3_variant_count": 1, "ja3_variants": [ "49f6a1e16209aa18f85b942e79cde4bc" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d150400_8daaf6152771_bce43051f4df", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Shares its JA4_c (bce43051f4df) with 1 fingerprint classified as browser, and nothing else in that family disagrees \u2014 the same tool under different cipher options. Inferred from the family, not observed directly.", "ja4": { "a": "t12d150400", "b": "8daaf6152771", "c": "bce43051f4df", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-65281-51-11,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788512719, "last_seen": 1788512719, "transport": "t", "ja3_hash": "75fd5531de3dbb956b250a752db9cf05", "ja3_variant_count": 1, "ja3_variants": [ "75fd5531de3dbb956b250a752db9cf05" ], "user_agents": [], "ua_disagreement": false }, "inferred_from_family": true }, { "hash": "t12d150400_8daaf6152771_bdc91fe8a595", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150400", "b": "8daaf6152771", "c": "bdc91fe8a595", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-0-18-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 4, "first_seen": 1788790788, "last_seen": 1790910323, "transport": "t", "ja3_hash": "75103551cf572caf25a00a7c6ed9650d", "ja3_variant_count": 4, "ja3_variants": [ "75103551cf572caf25a00a7c6ed9650d", "0900dbc867d8b5032d14fd27f5e7febc", "69a9b21fd44593456306a63b6c599686", "a43ebe16a0ef24109a7d018f44d0bdfb" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 13_0_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0 Safari/537.36 Edg/129.0.0": 2, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36 Edg/153.0.0.0": 10, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d150400_8daaf6152771_d843c6637762", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150400", "b": "8daaf6152771", "c": "d843c6637762", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-13-5-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790510899, "last_seen": 1790510899, "transport": "t", "ja3_hash": "a15338c85798b70ae9c1d562ffdd5517", "ja3_variant_count": 1, "ja3_variants": [ "a15338c85798b70ae9c1d562ffdd5517" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d150400_8daaf6152771_f359bec8aaa4", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150400", "b": "8daaf6152771", "c": "f359bec8aaa4", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-0-45-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 0, "name": "server_name", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 2, "first_seen": 1788515785, "last_seen": 1788989489, "transport": "t", "ja3_hash": "d41915d1c528be97702a9e76df6a805d", "ja3_variant_count": 1, "ja3_variants": [ "d41915d1c528be97702a9e76df6a805d" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 1, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36 Edg/151.0.0.0": 2 }, "ua_disagreement": false } }, { "hash": "t12d150400_8daaf6152771_fe8352abbea0", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150400", "b": "8daaf6152771", "c": "fe8352abbea0", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 4, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-23-35-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788833254, "last_seen": 1788833254, "transport": "t", "ja3_hash": "99b464e16aec80d69ec528d8afaa49b0", "ja3_variant_count": 1, "ja3_variants": [ "99b464e16aec80d69ec528d8afaa49b0" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d1504h2_8daaf6152771_40894e57892c", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1504h2", "b": "8daaf6152771", "c": "40894e57892c", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 4, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-16-0-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 3, "first_seen": 1790415877, "last_seen": 1791245167, "transport": "t", "ja3_hash": "620b7178d69981b655ae48441dffa578", "ja3_variant_count": 3, "ja3_variants": [ "620b7178d69981b655ae48441dffa578", "3822e822897b68b2774ac54fbccb1324", "9b16098aa59fab415a7ca363c3c16580" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36": 16, "Mozilla/5.0 (Linux; Android 14; Pixel 8 Pro) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d1504h2_8daaf6152771_5270fb343167", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1504h2", "b": "8daaf6152771", "c": "5270fb343167", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 4, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-65037-16-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 3, "first_seen": 1788777957, "last_seen": 1791279242, "transport": "t", "ja3_hash": "f4e736d63269075fb2a230f3520c0d82", "ja3_variant_count": 3, "ja3_variants": [ "f4e736d63269075fb2a230f3520c0d82", "757e25d9e13d08a4fcba4ec6a8cffcf2", "67289aa1306c79320cb3268748654987" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36": 8, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d1504h2_8daaf6152771_91f3c070d38b", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1504h2", "b": "8daaf6152771", "c": "91f3c070d38b", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 4, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-0-16-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790281519, "last_seen": 1790281519, "transport": "t", "ja3_hash": "a06cc17b7f2dd0e36be51994d10ac64e", "ja3_variant_count": 1, "ja3_variants": [ "a06cc17b7f2dd0e36be51994d10ac64e" ], "user_agents": { "Mozilla/5.0 (iPhone; CPU iPhone OS 18_5 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/147.0.0.0 Mobile/15E148 Safari/604.1": 1 }, "ua_disagreement": false } }, { "hash": "t12d1504h2_8daaf6152771_a3de4d7beb08", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1504h2", "b": "8daaf6152771", "c": "a3de4d7beb08", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 4, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-5-0-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 2, "first_seen": 1790968479, "last_seen": 1791040360, "transport": "t", "ja3_hash": "dd165899a15dd86c8a4e5e5a29b172ea", "ja3_variant_count": 2, "ja3_variants": [ "dd165899a15dd86c8a4e5e5a29b172ea", "b6706bf2bc6f7fcd523973175650596c" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 10 }, "ua_disagreement": false } }, { "hash": "t12d150500_8daaf6152771_007001663a17", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150500", "b": "8daaf6152771", "c": "007001663a17", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-10-51-0-65037,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790207898, "last_seen": 1790207898, "transport": "t", "ja3_hash": "38947c1ec76a0c67601dcde96c6165cc", "ja3_variant_count": 1, "ja3_variants": [ "38947c1ec76a0c67601dcde96c6165cc" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d150500_8daaf6152771_01b551f0285a", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150500", "b": "8daaf6152771", "c": "01b551f0285a", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-0-51764-17613-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790643773, "last_seen": 1790643773, "transport": "t", "ja3_hash": "d6269f2deb83311a1b805a1cd7efda45", "ja3_variant_count": 1, "ja3_variants": [ "d6269f2deb83311a1b805a1cd7efda45" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 6 }, "ua_disagreement": false } }, { "hash": "t12d150500_8daaf6152771_05b8361b8cd8", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150500", "b": "8daaf6152771", "c": "05b8361b8cd8", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-10-13-51-0,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 0, "name": "server_name", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790192506, "last_seen": 1790192506, "transport": "t", "ja3_hash": "40f4aac36c5f0c9ed587cbca4eefdf5a", "ja3_variant_count": 1, "ja3_variants": [ "40f4aac36c5f0c9ed587cbca4eefdf5a" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36": 4 }, "ua_disagreement": false } }, { "hash": "t12d150500_8daaf6152771_0a4f5daca207", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150500", "b": "8daaf6152771", "c": "0a4f5daca207", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-45-0-17613-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789192696, "last_seen": 1789192696, "transport": "t", "ja3_hash": "0f2a4d9dbd16c812f4877b279fa83e3d", "ja3_variant_count": 1, "ja3_variants": [ "0f2a4d9dbd16c812f4877b279fa83e3d" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 11 }, "ua_disagreement": false } }, { "hash": "t12d150500_8daaf6152771_0d19229a8da4", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150500", "b": "8daaf6152771", "c": "0d19229a8da4", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-51-0-13-35,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790221416, "last_seen": 1790221416, "transport": "t", "ja3_hash": "ce9826d35e70f13187b84147e09bce07", "ja3_variant_count": 1, "ja3_variants": [ "ce9826d35e70f13187b84147e09bce07" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d150500_8daaf6152771_14b11f3ff465", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150500", "b": "8daaf6152771", "c": "14b11f3ff465", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-65037-0-35-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789054644, "last_seen": 1789054644, "transport": "t", "ja3_hash": "3e689b4ba65a8e0df0ebb877279e6cad", "ja3_variant_count": 1, "ja3_variants": [ "3e689b4ba65a8e0df0ebb877279e6cad" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 5 }, "ua_disagreement": false } }, { "hash": "t12d150500_8daaf6152771_1bf5e79c9bf2", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150500", "b": "8daaf6152771", "c": "1bf5e79c9bf2", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51764-0-23-17613-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790760780, "last_seen": 1790760780, "transport": "t", "ja3_hash": "ad722c72d0dbced5890a2f4451c69867", "ja3_variant_count": 1, "ja3_variants": [ "ad722c72d0dbced5890a2f4451c69867" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36": 3 }, "ua_disagreement": false } }, { "hash": "t12d150500_8daaf6152771_1c4fc591205b", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150500", "b": "8daaf6152771", "c": "1c4fc591205b", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-10-0-23-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791176884, "last_seen": 1791176884, "transport": "t", "ja3_hash": "78cc4ef268e34abbcd88fe99c45c48ac", "ja3_variant_count": 1, "ja3_variants": [ "78cc4ef268e34abbcd88fe99c45c48ac" ], "user_agents": { "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d150500_8daaf6152771_2723e6fcfe73", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150500", "b": "8daaf6152771", "c": "2723e6fcfe73", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-27-0-35-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788567599, "last_seen": 1788567599, "transport": "t", "ja3_hash": "b5ee3dbf11a44ed29a0dd4a2dd0e51cb", "ja3_variant_count": 1, "ja3_variants": [ "b5ee3dbf11a44ed29a0dd4a2dd0e51cb" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d150500_8daaf6152771_2959dded2a39", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150500", "b": "8daaf6152771", "c": "2959dded2a39", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-11-35-65037-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790247368, "last_seen": 1790247368, "transport": "t", "ja3_hash": "7e291676dcff52016ee7abfc24a8ef5d", "ja3_variant_count": 1, "ja3_variants": [ "7e291676dcff52016ee7abfc24a8ef5d" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d150500_8daaf6152771_2f4d6073885a", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150500", "b": "8daaf6152771", "c": "2f4d6073885a", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-27-13-10-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790236673, "last_seen": 1790236673, "transport": "t", "ja3_hash": "c96e56b6f8578e905c2e6e836383f0fe", "ja3_variant_count": 1, "ja3_variants": [ "c96e56b6f8578e905c2e6e836383f0fe" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d150500_8daaf6152771_35b6f56c7eb3", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150500", "b": "8daaf6152771", "c": "35b6f56c7eb3", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-51-45-0-65037,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 3, "first_seen": 1789830196, "last_seen": 1790509503, "transport": "t", "ja3_hash": "1f4d8c317f9ecdadcf41e1fb5d1f0b68", "ja3_variant_count": 3, "ja3_variants": [ "1f4d8c317f9ecdadcf41e1fb5d1f0b68", "f67a3853c4edb192b23e9a51b8031ae0", "d4246604fa65c83014dd528ae4a88c95" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 10 }, "ua_disagreement": false } }, { "hash": "t12d150500_8daaf6152771_422e79384709", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150500", "b": "8daaf6152771", "c": "422e79384709", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-0-51-5-65037,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790720690, "last_seen": 1790720690, "transport": "t", "ja3_hash": "45cbb6b40bd64756376cbc508aa31beb", "ja3_variant_count": 1, "ja3_variants": [ "45cbb6b40bd64756376cbc508aa31beb" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d150500_8daaf6152771_49e314b495ab", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150500", "b": "8daaf6152771", "c": "49e314b495ab", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-0-5-45-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789457563, "last_seen": 1789457563, "transport": "t", "ja3_hash": "7e7c5a62cac942be51216f743a2ff71b", "ja3_variant_count": 1, "ja3_variants": [ "7e7c5a62cac942be51216f743a2ff71b" ], "user_agents": { "Mozilla/5.0 (iPhone; CPU iPhone OS 13_2_3 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/13.0.3 Mobile/15E148 Safari/604.1": 1 }, "ua_disagreement": false } }, { "hash": "t12d150500_8daaf6152771_4b474f64fce1", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150500", "b": "8daaf6152771", "c": "4b474f64fce1", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-17613-0-51764-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 0, "name": "server_name", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 2, "first_seen": 1790729582, "last_seen": 1790781924, "transport": "t", "ja3_hash": "771c01e8bef3a59fb90810041c0bb2b4", "ja3_variant_count": 2, "ja3_variants": [ "771c01e8bef3a59fb90810041c0bb2b4", "e8b4f5b583242a06b731934b989e1baf" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 7 }, "ua_disagreement": false } }, { "hash": "t12d150500_8daaf6152771_577fd7d1a7ef", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150500", "b": "8daaf6152771", "c": "577fd7d1a7ef", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-0-17613-65281-10,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 3, "first_seen": 1789928042, "last_seen": 1791256247, "transport": "t", "ja3_hash": "d5d88e62ad09f6efb3661036d6378abd", "ja3_variant_count": 2, "ja3_variants": [ "d5d88e62ad09f6efb3661036d6378abd", "58ef74737812cb729b4b1ce6bd22b5af" ], "user_agents": { "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36": 11, "Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.2745.61 Safari/537.36": 1, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/73.0.2213.67 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d150500_8daaf6152771_5f8d5c2177c6", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150500", "b": "8daaf6152771", "c": "5f8d5c2177c6", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-0-35-51764-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791221842, "last_seen": 1791221842, "transport": "t", "ja3_hash": "e3f7b9703dd44a8cc156829f550862cf", "ja3_variant_count": 1, "ja3_variants": [ "e3f7b9703dd44a8cc156829f550862cf" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36": 21 }, "ua_disagreement": false } }, { "hash": "t12d150500_8daaf6152771_65625441a93e", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150500", "b": "8daaf6152771", "c": "65625441a93e", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51764-65281-5-0-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791241557, "last_seen": 1791241557, "transport": "t", "ja3_hash": "899d731b4d759a6a2d658f2bc38a1e2c", "ja3_variant_count": 1, "ja3_variants": [ "899d731b4d759a6a2d658f2bc38a1e2c" ], "user_agents": { "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Mobile Safari/537.36": 4 }, "ua_disagreement": false } }, { "hash": "t12d150500_8daaf6152771_7066f31dd90e", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150500", "b": "8daaf6152771", "c": "7066f31dd90e", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-23-13-27-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 2, "first_seen": 1790053080, "last_seen": 1791230281, "transport": "t", "ja3_hash": "97069977f7279a6a3e21cefc32bb8c6a", "ja3_variant_count": 2, "ja3_variants": [ "97069977f7279a6a3e21cefc32bb8c6a", "0b1b69eafa0dfaa25535025f1ece69d1" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36": 10, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 10 }, "ua_disagreement": false } }, { "hash": "t12d150500_8daaf6152771_7d93667b39c4", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150500", "b": "8daaf6152771", "c": "7d93667b39c4", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-0-17613-35-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790538509, "last_seen": 1790538509, "transport": "t", "ja3_hash": "c8a26652a3bc5c6fb4a9de6728271cb1", "ja3_variant_count": 1, "ja3_variants": [ "c8a26652a3bc5c6fb4a9de6728271cb1" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36 Edg/136.0.0.0": 1 }, "ua_disagreement": false } }, { "hash": "t12d150500_8daaf6152771_9120ef33c320", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150500", "b": "8daaf6152771", "c": "9120ef33c320", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-51-65281-0-51764,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789390431, "last_seen": 1789390431, "transport": "t", "ja3_hash": "c31515a9049f8c12a2611c64f5025b00", "ja3_variant_count": 1, "ja3_variants": [ "c31515a9049f8c12a2611c64f5025b00" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 14 }, "ua_disagreement": false } }, { "hash": "t12d150500_8daaf6152771_94197eb55619", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150500", "b": "8daaf6152771", "c": "94197eb55619", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-27-11-51-51764,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790929065, "last_seen": 1790929065, "transport": "t", "ja3_hash": "e412374c91db4c35f5c426616c7f9955", "ja3_variant_count": 1, "ja3_variants": [ "e412374c91db4c35f5c426616c7f9955" ], "user_agents": { "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 4 }, "ua_disagreement": false } }, { "hash": "t12d150500_8daaf6152771_997359a1bd4b", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150500", "b": "8daaf6152771", "c": "997359a1bd4b", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-51-18-17613-10,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 10, "name": "supported_groups", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789702108, "last_seen": 1789702108, "transport": "t", "ja3_hash": "5442487a08e92db2d4d48d163a1c7941", "ja3_variant_count": 1, "ja3_variants": [ "5442487a08e92db2d4d48d163a1c7941" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36": 3 }, "ua_disagreement": false } }, { "hash": "t12d150500_8daaf6152771_9a4d5754f06a", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150500", "b": "8daaf6152771", "c": "9a4d5754f06a", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-65281-65037-0-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 2, "first_seen": 1788990746, "last_seen": 1790553846, "transport": "t", "ja3_hash": "c7c011436d3b89f108e79e67ce99ff1e", "ja3_variant_count": 2, "ja3_variants": [ "c7c011436d3b89f108e79e67ce99ff1e", "0ac8780662ae4ba261c530ac53db4049" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12d150500_8daaf6152771_a5d7afc45084", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150500", "b": "8daaf6152771", "c": "a5d7afc45084", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-13-0-17613-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 2, "first_seen": 1788582206, "last_seen": 1791120949, "transport": "t", "ja3_hash": "9dcb3fa8929bd767022ec02f0ab2ce99", "ja3_variant_count": 1, "ja3_variants": [ "9dcb3fa8929bd767022ec02f0ab2ce99" ], "user_agents": { "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Mobile Safari/537.36": 2, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d150500_8daaf6152771_a8fdd8627eb3", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150500", "b": "8daaf6152771", "c": "a8fdd8627eb3", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-17613-0-23-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790203254, "last_seen": 1790203254, "transport": "t", "ja3_hash": "41c202c40cba1e77f23737f46af68410", "ja3_variant_count": 1, "ja3_variants": [ "41c202c40cba1e77f23737f46af68410" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d150500_8daaf6152771_ac1d0aa0e9e1", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150500", "b": "8daaf6152771", "c": "ac1d0aa0e9e1", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-45-10-65281-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789912780, "last_seen": 1789912780, "transport": "t", "ja3_hash": "b586484ffad3ce307942f999fb9c5671", "ja3_variant_count": 1, "ja3_variants": [ "b586484ffad3ce307942f999fb9c5671" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 9 }, "ua_disagreement": false } }, { "hash": "t12d150500_8daaf6152771_b5b2d70ae0d1", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150500", "b": "8daaf6152771", "c": "b5b2d70ae0d1", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-0-10-13-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789460105, "last_seen": 1789460105, "transport": "t", "ja3_hash": "ff23304cf1fc51c6c0097f6c597adca4", "ja3_variant_count": 1, "ja3_variants": [ "ff23304cf1fc51c6c0097f6c597adca4" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36 Edg/153.0.0.0": 18 }, "ua_disagreement": false } }, { "hash": "t12d150500_8daaf6152771_ba7e4154582f", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150500", "b": "8daaf6152771", "c": "ba7e4154582f", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-35-65037-10-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788768981, "last_seen": 1788768981, "transport": "t", "ja3_hash": "cdc0839291fb40c95a2569ade9d3a80e", "ja3_variant_count": 1, "ja3_variants": [ "cdc0839291fb40c95a2569ade9d3a80e" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12d150500_8daaf6152771_bec4aabafb7c", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150500", "b": "8daaf6152771", "c": "bec4aabafb7c", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-17613-5-0-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 5, "name": "status_request", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790165324, "last_seen": 1790165324, "transport": "t", "ja3_hash": "77693555b5c5ce228c5bd0ec969de6ec", "ja3_variant_count": 1, "ja3_variants": [ "77693555b5c5ce228c5bd0ec969de6ec" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d150500_8daaf6152771_c7e813a58745", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150500", "b": "8daaf6152771", "c": "c7e813a58745", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-65281-27-17613-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790836281, "last_seen": 1790836281, "transport": "t", "ja3_hash": "1cd2c6556f7fc482ae62699425233dc3", "ja3_variant_count": 1, "ja3_variants": [ "1cd2c6556f7fc482ae62699425233dc3" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d150500_8daaf6152771_d46fcfef73cd", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150500", "b": "8daaf6152771", "c": "d46fcfef73cd", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-27-0-23-65037,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790435857, "last_seen": 1790435857, "transport": "t", "ja3_hash": "ef8fc2d3d935682dbcae6779bc85716d", "ja3_variant_count": 1, "ja3_variants": [ "ef8fc2d3d935682dbcae6779bc85716d" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d150500_8daaf6152771_d74481ffed0b", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150500", "b": "8daaf6152771", "c": "d74481ffed0b", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-45-23-0-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790959673, "last_seen": 1790959673, "transport": "t", "ja3_hash": "498828ff7cbe921f83e194ebbf5bdd00", "ja3_variant_count": 1, "ja3_variants": [ "498828ff7cbe921f83e194ebbf5bdd00" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d150500_8daaf6152771_ddb6b85e8b4d", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150500", "b": "8daaf6152771", "c": "ddb6b85e8b4d", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-0-17613-11-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791101360, "last_seen": 1791101360, "transport": "t", "ja3_hash": "de1f8aecb358702721df3cd45f75d22f", "ja3_variant_count": 1, "ja3_variants": [ "de1f8aecb358702721df3cd45f75d22f" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 10 }, "ua_disagreement": false } }, { "hash": "t12d150500_8daaf6152771_e9554f16cb8b", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150500", "b": "8daaf6152771", "c": "e9554f16cb8b", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-0-13-23-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789632507, "last_seen": 1789632507, "transport": "t", "ja3_hash": "0fad0ca15ecdcbc053c540e8a2049298", "ja3_variant_count": 1, "ja3_variants": [ "0fad0ca15ecdcbc053c540e8a2049298" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d150500_8daaf6152771_e975e2edfedf", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150500", "b": "8daaf6152771", "c": "e975e2edfedf", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-0-18-11-17613,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791110297, "last_seen": 1791110297, "transport": "t", "ja3_hash": "82fa10c8fb25692ed2dac86a5656bfeb", "ja3_variant_count": 1, "ja3_variants": [ "82fa10c8fb25692ed2dac86a5656bfeb" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 10 }, "ua_disagreement": false } }, { "hash": "t12d150500_8daaf6152771_e9a0d0082567", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150500", "b": "8daaf6152771", "c": "e9a0d0082567", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-17613-51-0-13,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788739257, "last_seen": 1788739257, "transport": "t", "ja3_hash": "05dba648f6a24787a9ec8ece3a788795", "ja3_variant_count": 1, "ja3_variants": [ "05dba648f6a24787a9ec8ece3a788795" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12d150500_8daaf6152771_eb679901f2d8", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150500", "b": "8daaf6152771", "c": "eb679901f2d8", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 5, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-13-10-0-65037,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788799072, "last_seen": 1788799072, "transport": "t", "ja3_hash": "45de6a4258047467ae112635211e49e0", "ja3_variant_count": 1, "ja3_variants": [ "45de6a4258047467ae112635211e49e0" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d1505h1_8daaf6152771_0eb513a80caa", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1505h1", "b": "8daaf6152771", "c": "0eb513a80caa", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 5, "alpn": "h1" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-16-0-65281-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790561834, "last_seen": 1790561834, "transport": "t", "ja3_hash": "c1f7c968fb1068dea0c90b551fb0d8a3", "ja3_variant_count": 1, "ja3_variants": [ "c1f7c968fb1068dea0c90b551fb0d8a3" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d1505h1_8daaf6152771_9b96c9dffd4b", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1505h1", "b": "8daaf6152771", "c": "9b96c9dffd4b", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 5, "alpn": "h1" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-65281-51-16-65037,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790989581, "last_seen": 1790989581, "transport": "t", "ja3_hash": "08e831547e2ad79316a37a85eb4133b4", "ja3_variant_count": 1, "ja3_variants": [ "08e831547e2ad79316a37a85eb4133b4" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d1505h1_8daaf6152771_b188ee82f7b5", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1505h1", "b": "8daaf6152771", "c": "b188ee82f7b5", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 5, "alpn": "h1" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-18-16-0-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790648319, "last_seen": 1790648319, "transport": "t", "ja3_hash": "8644bb9d642b44367c0e51866f14d794", "ja3_variant_count": 1, "ja3_variants": [ "8644bb9d642b44367c0e51866f14d794" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d1505h2_8daaf6152771_1947a2a29e9e", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1505h2", "b": "8daaf6152771", "c": "1947a2a29e9e", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 5, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-27-0-16-10,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 10, "name": "supported_groups", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 2, "first_seen": 1790241497, "last_seen": 1790708534, "transport": "t", "ja3_hash": "9ba65fd7402c334cfd72000569fb54ca", "ja3_variant_count": 2, "ja3_variants": [ "9ba65fd7402c334cfd72000569fb54ca", "a3ef1760ed8ccb1569321f6466e6ccdc" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36 Edg/154.0.0.0": 19 }, "ua_disagreement": false } }, { "hash": "t12d1505h2_8daaf6152771_1c1cb2907876", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1505h2", "b": "8daaf6152771", "c": "1c1cb2907876", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 5, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-0-16-13-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791263936, "last_seen": 1791263936, "transport": "t", "ja3_hash": "fcdd45a6548d842c4f9859c6b3ac4475", "ja3_variant_count": 1, "ja3_variants": [ "fcdd45a6548d842c4f9859c6b3ac4475" ], "user_agents": { "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36": 6 }, "ua_disagreement": false } }, { "hash": "t12d1505h2_8daaf6152771_38867ffa8acc", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1505h2", "b": "8daaf6152771", "c": "38867ffa8acc", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 5, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-11-51-16-65037,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790929146, "last_seen": 1790929146, "transport": "t", "ja3_hash": "673d3a8cfaba44755511e0ae0dc7b5cd", "ja3_variant_count": 1, "ja3_variants": [ "673d3a8cfaba44755511e0ae0dc7b5cd" ], "user_agents": { "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d1505h2_8daaf6152771_3f09f704fcf3", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1505h2", "b": "8daaf6152771", "c": "3f09f704fcf3", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 5, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-16-0-23-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788508424, "last_seen": 1788508424, "transport": "t", "ja3_hash": "bef765ee5f616373a3f840c4164d6d54", "ja3_variant_count": 1, "ja3_variants": [ "bef765ee5f616373a3f840c4164d6d54" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 2 }, "ua_disagreement": false } }, { "hash": "t12d1505h2_8daaf6152771_46d0802ea15d", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1505h2", "b": "8daaf6152771", "c": "46d0802ea15d", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 5, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-16-0-18-10,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 10, "name": "supported_groups", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790228658, "last_seen": 1790228658, "transport": "t", "ja3_hash": "f2a45a445ff17b6e3a3b922cca148ec6", "ja3_variant_count": 1, "ja3_variants": [ "f2a45a445ff17b6e3a3b922cca148ec6" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d1505h2_8daaf6152771_664313b0eef1", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1505h2", "b": "8daaf6152771", "c": "664313b0eef1", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 5, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51764-0-18-16-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 0, "name": "server_name", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791008203, "last_seen": 1791008203, "transport": "t", "ja3_hash": "6e468499d83bd64874b1c7ac7aceb543", "ja3_variant_count": 1, "ja3_variants": [ "6e468499d83bd64874b1c7ac7aceb543" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d1505h2_8daaf6152771_68bbcabf7144", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1505h2", "b": "8daaf6152771", "c": "68bbcabf7144", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 5, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-17613-0-16-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 0, "name": "server_name", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 2, "first_seen": 1790035332, "last_seen": 1790180359, "transport": "t", "ja3_hash": "6252fc41d94cf8a78f2bbd0a7824cd79", "ja3_variant_count": 2, "ja3_variants": [ "6252fc41d94cf8a78f2bbd0a7824cd79", "ea5462a421ca0d2dd97d0876ea19ab79" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d1505h2_8daaf6152771_88a07e081333", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1505h2", "b": "8daaf6152771", "c": "88a07e081333", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 5, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-35-0-51-13,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790879672, "last_seen": 1790879672, "transport": "t", "ja3_hash": "5c5817605a1d6db7ea59f77da790cb05", "ja3_variant_count": 1, "ja3_variants": [ "5c5817605a1d6db7ea59f77da790cb05" ], "user_agents": { "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Mobile Safari/537.36": 3 }, "ua_disagreement": false } }, { "hash": "t12d1505h2_8daaf6152771_9b2569eb22d1", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1505h2", "b": "8daaf6152771", "c": "9b2569eb22d1", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 5, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-0-16-27-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790539889, "last_seen": 1790539889, "transport": "t", "ja3_hash": "aa126b6bab4b07f573b0cd8b1eae1d9d", "ja3_variant_count": 1, "ja3_variants": [ "aa126b6bab4b07f573b0cd8b1eae1d9d" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d1505h2_8daaf6152771_b188ee82f7b5", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1505h2", "b": "8daaf6152771", "c": "b188ee82f7b5", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 5, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-0-51-16-18,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790193885, "last_seen": 1790193885, "transport": "t", "ja3_hash": "06ce0dfc176dd51325c2987cfc46ee1f", "ja3_variant_count": 1, "ja3_variants": [ "06ce0dfc176dd51325c2987cfc46ee1f" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d1505h2_8daaf6152771_c00f61877593", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1505h2", "b": "8daaf6152771", "c": "c00f61877593", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 5, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-16-51-45-13,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791170662, "last_seen": 1791170662, "transport": "t", "ja3_hash": "06cb4b7eed9611ea904858da2d37db26", "ja3_variant_count": 1, "ja3_variants": [ "06cb4b7eed9611ea904858da2d37db26" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 10 }, "ua_disagreement": false } }, { "hash": "t12d1505h2_8daaf6152771_c04ed08e4e34", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1505h2", "b": "8daaf6152771", "c": "c04ed08e4e34", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 5, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-11-45-16-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789479895, "last_seen": 1789479895, "transport": "t", "ja3_hash": "3175317ec9ffcac00ca85ccea360fd99", "ja3_variant_count": 1, "ja3_variants": [ "3175317ec9ffcac00ca85ccea360fd99" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 18 }, "ua_disagreement": false } }, { "hash": "t12d1505h2_8daaf6152771_ccfaee51b21a", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1505h2", "b": "8daaf6152771", "c": "ccfaee51b21a", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 5, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-17613-16-0-13,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788723989, "last_seen": 1788723989, "transport": "t", "ja3_hash": "a450d26e628e7b4abb97b06b2b2af1b1", "ja3_variant_count": 1, "ja3_variants": [ "a450d26e628e7b4abb97b06b2b2af1b1" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 25 }, "ua_disagreement": false } }, { "hash": "t12d1505h2_8daaf6152771_d4e7110f08a4", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1505h2", "b": "8daaf6152771", "c": "d4e7110f08a4", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 5, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-16-0-23-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789591775, "last_seen": 1789591775, "transport": "t", "ja3_hash": "1764491cedc065ae351655249b01e441", "ja3_variant_count": 1, "ja3_variants": [ "1764491cedc065ae351655249b01e441" ], "user_agents": { "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36": 3 }, "ua_disagreement": false } }, { "hash": "t12d150600_8daaf6152771_024fa6635255", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150600", "b": "8daaf6152771", "c": "024fa6635255", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-5-13-0-35-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791015198, "last_seen": 1791015198, "transport": "t", "ja3_hash": "62ada7b786266f675deecabaf5f92cc2", "ja3_variant_count": 1, "ja3_variants": [ "62ada7b786266f675deecabaf5f92cc2" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36": 3 }, "ua_disagreement": false } }, { "hash": "t12d150600_8daaf6152771_0d14bc4f6f25", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150600", "b": "8daaf6152771", "c": "0d14bc4f6f25", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-18-65037-10-23-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789811738, "last_seen": 1789811738, "transport": "t", "ja3_hash": "a5ee3b99d5fa719d03cd63246e711f90", "ja3_variant_count": 1, "ja3_variants": [ "a5ee3b99d5fa719d03cd63246e711f90" ], "user_agents": { "Mozilla/5.0 (iPhone; CPU iPhone OS 18_4 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/151.0.0.0 Mobile/15E148 Safari/604.1": 4 }, "ua_disagreement": false } }, { "hash": "t12d150600_8daaf6152771_0d976db533bc", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150600", "b": "8daaf6152771", "c": "0d976db533bc", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-27-45-13-0-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790823214, "last_seen": 1790823214, "transport": "t", "ja3_hash": "2e92121f17bd7a6906589be0f2aa903a", "ja3_variant_count": 1, "ja3_variants": [ "2e92121f17bd7a6906589be0f2aa903a" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 10 }, "ua_disagreement": false } }, { "hash": "t12d150600_8daaf6152771_1004d47f6768", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150600", "b": "8daaf6152771", "c": "1004d47f6768", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-35-0-5-18-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790272593, "last_seen": 1790272593, "transport": "t", "ja3_hash": "eae0216412d7a449876f581b7dceba7b", "ja3_variant_count": 1, "ja3_variants": [ "eae0216412d7a449876f581b7dceba7b" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 10 }, "ua_disagreement": false } }, { "hash": "t12d150600_8daaf6152771_12611357a112", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150600", "b": "8daaf6152771", "c": "12611357a112", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-23-0-17613-13-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790252243, "last_seen": 1790252243, "transport": "t", "ja3_hash": "744e330e4f8cb5de2e893bae6b9a9433", "ja3_variant_count": 1, "ja3_variants": [ "744e330e4f8cb5de2e893bae6b9a9433" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 14 }, "ua_disagreement": false } }, { "hash": "t12d150600_8daaf6152771_131158e7c874", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150600", "b": "8daaf6152771", "c": "131158e7c874", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-11-13-51764-0-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790615558, "last_seen": 1790615558, "transport": "t", "ja3_hash": "633b029b26b638617c5f775166c0a405", "ja3_variant_count": 1, "ja3_variants": [ "633b029b26b638617c5f775166c0a405" ], "user_agents": { "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d150600_8daaf6152771_1d64783a6a85", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150600", "b": "8daaf6152771", "c": "1d64783a6a85", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-51-0-17613-45-16,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790232124, "last_seen": 1790232124, "transport": "t", "ja3_hash": "0fb2b24119def5843d13471af85d11a1", "ja3_variant_count": 1, "ja3_variants": [ "0fb2b24119def5843d13471af85d11a1" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d150600_8daaf6152771_23be13b33bcb", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150600", "b": "8daaf6152771", "c": "23be13b33bcb", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-17613-0-45-18-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 0, "name": "server_name", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789690374, "last_seen": 1789690374, "transport": "t", "ja3_hash": "6828276b535bc596de1b9a05dff46182", "ja3_variant_count": 1, "ja3_variants": [ "6828276b535bc596de1b9a05dff46182" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12d150600_8daaf6152771_28335c63a606", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150600", "b": "8daaf6152771", "c": "28335c63a606", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-13-65281-35-0-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790789322, "last_seen": 1790789322, "transport": "t", "ja3_hash": "c64e469220d538f6cbcf5c44d4674ae2", "ja3_variant_count": 1, "ja3_variants": [ "c64e469220d538f6cbcf5c44d4674ae2" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d150600_8daaf6152771_2b60fbb3243e", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150600", "b": "8daaf6152771", "c": "2b60fbb3243e", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-45-11-51-13-27,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 27, "name": "compress_certificate", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790380861, "last_seen": 1790380861, "transport": "t", "ja3_hash": "e9720e5e0111b687de4fce0225a6acd5", "ja3_variant_count": 1, "ja3_variants": [ "e9720e5e0111b687de4fce0225a6acd5" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36": 16 }, "ua_disagreement": false } }, { "hash": "t12d150600_8daaf6152771_2b9b8b1a42cc", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150600", "b": "8daaf6152771", "c": "2b9b8b1a42cc", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-45-0-10-65281-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790227156, "last_seen": 1790227156, "transport": "t", "ja3_hash": "a193e540e88559300695255521edf14c", "ja3_variant_count": 1, "ja3_variants": [ "a193e540e88559300695255521edf14c" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d150600_8daaf6152771_3752a382b945", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150600", "b": "8daaf6152771", "c": "3752a382b945", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-27-0-35-65281-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790575090, "last_seen": 1790575090, "transport": "t", "ja3_hash": "ec7dc082c6228f1a3792d415c9b9fe85", "ja3_variant_count": 1, "ja3_variants": [ "ec7dc082c6228f1a3792d415c9b9fe85" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 10 }, "ua_disagreement": false } }, { "hash": "t12d150600_8daaf6152771_376d32bdcd8d", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150600", "b": "8daaf6152771", "c": "376d32bdcd8d", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-65281-18-0-11-65037,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788796280, "last_seen": 1788796280, "transport": "t", "ja3_hash": "6515ef9da20b9094d6a693cd99ed3ec7", "ja3_variant_count": 1, "ja3_variants": [ "6515ef9da20b9094d6a693cd99ed3ec7" ], "user_agents": { "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36": 2 }, "ua_disagreement": false } }, { "hash": "t12d150600_8daaf6152771_43945de3600f", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150600", "b": "8daaf6152771", "c": "43945de3600f", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-27-18-13-0-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789192487, "last_seen": 1789192487, "transport": "t", "ja3_hash": "29347974130f21201ef2b44706044be1", "ja3_variant_count": 1, "ja3_variants": [ "29347974130f21201ef2b44706044be1" ], "user_agents": { "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36": 40 }, "ua_disagreement": false } }, { "hash": "t12d150600_8daaf6152771_4417834f9441", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150600", "b": "8daaf6152771", "c": "4417834f9441", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-51-0-5-10-27,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 27, "name": "compress_certificate", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790541538, "last_seen": 1790541538, "transport": "t", "ja3_hash": "2b15e196a08e63c6c82d52d534ef4d07", "ja3_variant_count": 1, "ja3_variants": [ "2b15e196a08e63c6c82d52d534ef4d07" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d150600_8daaf6152771_46bbdc7f7577", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150600", "b": "8daaf6152771", "c": "46bbdc7f7577", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-35-0-13-65281-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789675751, "last_seen": 1789675751, "transport": "t", "ja3_hash": "586f0532a1039afbe16995e7fac33d29", "ja3_variant_count": 1, "ja3_variants": [ "586f0532a1039afbe16995e7fac33d29" ], "user_agents": { "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d150600_8daaf6152771_4836e47f79ed", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150600", "b": "8daaf6152771", "c": "4836e47f79ed", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-65281-17513-35-5-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 17513, "name": "application_settings", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788990253, "last_seen": 1788990253, "transport": "t", "ja3_hash": "adea50ceca72ff001ecb8ea0f3370ddf", "ja3_variant_count": 1, "ja3_variants": [ "adea50ceca72ff001ecb8ea0f3370ddf" ], "user_agents": { "Mozilla/5.0 (Linux; Android 8.0.0; SM-J330G) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Mobile Safari/537.36 EdgA/114.0.1823.74": 1 }, "ua_disagreement": false } }, { "hash": "t12d150600_8daaf6152771_50292b905dab", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150600", "b": "8daaf6152771", "c": "50292b905dab", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-0-65281-18-27-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790794692, "last_seen": 1790794692, "transport": "t", "ja3_hash": "741acb81acde121440b102df37041637", "ja3_variant_count": 1, "ja3_variants": [ "741acb81acde121440b102df37041637" ], "user_agents": { "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Mobile Safari/537.36 EdgA/154.0.0.0": 2 }, "ua_disagreement": false } }, { "hash": "t12d150600_8daaf6152771_53118166ac2a", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150600", "b": "8daaf6152771", "c": "53118166ac2a", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-45-0-35-23-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789998862, "last_seen": 1789998862, "transport": "t", "ja3_hash": "03bb01de3fe3533cd834595873e972ba", "ja3_variant_count": 1, "ja3_variants": [ "03bb01de3fe3533cd834595873e972ba" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d150600_8daaf6152771_5d9af4d6fd74", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150600", "b": "8daaf6152771", "c": "5d9af4d6fd74", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-23-0-18-5-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790977996, "last_seen": 1790977996, "transport": "t", "ja3_hash": "6fd948227b6db902c41429e0629ae586", "ja3_variant_count": 1, "ja3_variants": [ "6fd948227b6db902c41429e0629ae586" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d150600_8daaf6152771_5dc507bef692", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150600", "b": "8daaf6152771", "c": "5dc507bef692", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-13-51-5-17613-27,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 27, "name": "compress_certificate", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788552753, "last_seen": 1788552753, "transport": "t", "ja3_hash": "ff2306865ea5d127325ba5b88a9940bb", "ja3_variant_count": 1, "ja3_variants": [ "ff2306865ea5d127325ba5b88a9940bb" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36": 2 }, "ua_disagreement": false } }, { "hash": "t12d150600_8daaf6152771_633ce7eb0743", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150600", "b": "8daaf6152771", "c": "633ce7eb0743", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-27-51-0-10-65037,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 2, "first_seen": 1790365784, "last_seen": 1790670922, "transport": "t", "ja3_hash": "e11b2465f3486c8284e30df3a8d02f89", "ja3_variant_count": 2, "ja3_variants": [ "e11b2465f3486c8284e30df3a8d02f89", "697c748b2be9a55ae8879fb2c0b9dce6" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 10 }, "ua_disagreement": false } }, { "hash": "t12d150600_8daaf6152771_67aba61281a0", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150600", "b": "8daaf6152771", "c": "67aba61281a0", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-10-27-0-5-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791272578, "last_seen": 1791272578, "transport": "t", "ja3_hash": "7c6831f2114bf993ceaf1de4cf9961a2", "ja3_variant_count": 1, "ja3_variants": [ "7c6831f2114bf993ceaf1de4cf9961a2" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36": 30 }, "ua_disagreement": false } }, { "hash": "t12d150600_8daaf6152771_700a63e53eaa", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150600", "b": "8daaf6152771", "c": "700a63e53eaa", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-27-23-13-51-0,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 0, "name": "server_name", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788838921, "last_seen": 1788838921, "transport": "t", "ja3_hash": "3d581796eb10f74970b9012f647c1fc2", "ja3_variant_count": 1, "ja3_variants": [ "3d581796eb10f74970b9012f647c1fc2" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d150600_8daaf6152771_705701b9825e", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150600", "b": "8daaf6152771", "c": "705701b9825e", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-65281-45-0-65037-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790555517, "last_seen": 1790555517, "transport": "t", "ja3_hash": "98a95e8c4851c862da434dad36957165", "ja3_variant_count": 1, "ja3_variants": [ "98a95e8c4851c862da434dad36957165" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d150600_8daaf6152771_7195a055c943", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150600", "b": "8daaf6152771", "c": "7195a055c943", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-45-65037-23-17613-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 2, "first_seen": 1789697947, "last_seen": 1790236334, "transport": "t", "ja3_hash": "6e9dacd9c0a42d971920f76b5eaf06a5", "ja3_variant_count": 2, "ja3_variants": [ "6e9dacd9c0a42d971920f76b5eaf06a5", "9400e9eba7f8430ea49cbce31b395297" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 1, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d150600_8daaf6152771_727cc6ff3ce1", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150600", "b": "8daaf6152771", "c": "727cc6ff3ce1", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51764-10-27-0-65281-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789462090, "last_seen": 1789462090, "transport": "t", "ja3_hash": "88698f3e5c88bdd5ae294e253034f54d", "ja3_variant_count": 1, "ja3_variants": [ "88698f3e5c88bdd5ae294e253034f54d" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 7 }, "ua_disagreement": false } }, { "hash": "t12d150600_8daaf6152771_747eabef947b", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150600", "b": "8daaf6152771", "c": "747eabef947b", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-65037-10-13-0-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790209080, "last_seen": 1790209080, "transport": "t", "ja3_hash": "6c6b5fb91ec3b3269521b759434f7611", "ja3_variant_count": 1, "ja3_variants": [ "6c6b5fb91ec3b3269521b759434f7611" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d150600_8daaf6152771_759c230e9f8b", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150600", "b": "8daaf6152771", "c": "759c230e9f8b", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-65281-11-27-0-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790571805, "last_seen": 1790571805, "transport": "t", "ja3_hash": "a4af6291c94df935361b1c256c6c5c89", "ja3_variant_count": 1, "ja3_variants": [ "a4af6291c94df935361b1c256c6c5c89" ], "user_agents": { "Mozilla/5.0 (iPhone; CPU iPhone OS 18_5 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/147.0.0.0 Mobile/15E148 Safari/604.1": 1 }, "ua_disagreement": false } }, { "hash": "t12d150600_8daaf6152771_76d87293ca9d", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150600", "b": "8daaf6152771", "c": "76d87293ca9d", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-10-0-13-27-51,25497-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 25497, "name": "X25519Kyber768Draft00", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790645867, "last_seen": 1790645867, "transport": "t", "ja3_hash": "0b37f182ee6b44ac8359ca8eea8d5590", "ja3_variant_count": 1, "ja3_variants": [ "0b37f182ee6b44ac8359ca8eea8d5590" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d150600_8daaf6152771_77296b4d39a5", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150600", "b": "8daaf6152771", "c": "77296b4d39a5", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-65281-0-65037-27-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790983935, "last_seen": 1790983935, "transport": "t", "ja3_hash": "0543d220f7edb2735001b087fcba9370", "ja3_variant_count": 1, "ja3_variants": [ "0543d220f7edb2735001b087fcba9370" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d150600_8daaf6152771_8d47efcc3b6b", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150600", "b": "8daaf6152771", "c": "8d47efcc3b6b", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-10-51-45-0-65037,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789024333, "last_seen": 1789024333, "transport": "t", "ja3_hash": "0fe392f76712ed000578d97840249f7f", "ja3_variant_count": 1, "ja3_variants": [ "0fe392f76712ed000578d97840249f7f" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36 Edg/151.0.0.0": 10 }, "ua_disagreement": false } }, { "hash": "t12d150600_8daaf6152771_9195cb421bcb", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150600", "b": "8daaf6152771", "c": "9195cb421bcb", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-0-35-11-23-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789078359, "last_seen": 1789078359, "transport": "t", "ja3_hash": "630ad984c1236b7cbcd94b06353e204a", "ja3_variant_count": 1, "ja3_variants": [ "630ad984c1236b7cbcd94b06353e204a" ], "user_agents": { "Mozilla/5.0 (iPhone; CPU iPhone OS 18_7_6 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/26.0 Mobile/15E148 Safari/604.1": 10 }, "ua_disagreement": false } }, { "hash": "t12d150600_8daaf6152771_91dd0ebbcbdd", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150600", "b": "8daaf6152771", "c": "91dd0ebbcbdd", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-11-35-17613-0-65037,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 0, "name": "server_name", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789870119, "last_seen": 1789870119, "transport": "t", "ja3_hash": "56acc9aa784dd12c9426c087c41b83b5", "ja3_variant_count": 1, "ja3_variants": [ "56acc9aa784dd12c9426c087c41b83b5" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36 Edg/153.0.0.0": 1 }, "ua_disagreement": false } }, { "hash": "t12d150600_8daaf6152771_99b5757eeddc", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150600", "b": "8daaf6152771", "c": "99b5757eeddc", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-51-0-65037-11-17513,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 17513, "name": "application_settings", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791276532, "last_seen": 1791276532, "transport": "t", "ja3_hash": "89eab562615c653a865151d9bb9d9445", "ja3_variant_count": 1, "ja3_variants": [ "89eab562615c653a865151d9bb9d9445" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d150600_8daaf6152771_9e6c64868ac1", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150600", "b": "8daaf6152771", "c": "9e6c64868ac1", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-13-18-10-0-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790835316, "last_seen": 1790835316, "transport": "t", "ja3_hash": "df5aeeb5d5784bdbaf61842d960c4922", "ja3_variant_count": 1, "ja3_variants": [ "df5aeeb5d5784bdbaf61842d960c4922" ], "user_agents": { "Mozilla/5.0 (iPhone; CPU iPhone OS 18_2 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/149.0.0.0 Mobile/15E148 Safari/604.1": 1 }, "ua_disagreement": false } }, { "hash": "t12d150600_8daaf6152771_a900aa46d07b", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150600", "b": "8daaf6152771", "c": "a900aa46d07b", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-45-0-18-51-65037,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 2, "first_seen": 1789163315, "last_seen": 1789891737, "transport": "t", "ja3_hash": "25d9051ec4b0e46e198c2beb90f6a40b", "ja3_variant_count": 2, "ja3_variants": [ "25d9051ec4b0e46e198c2beb90f6a40b", "75f5fdfc6b3a1c2aff4d04166fdc3b0d" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d150600_8daaf6152771_a95800acf117", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150600", "b": "8daaf6152771", "c": "a95800acf117", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-10-17613-13-0-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789696447, "last_seen": 1789696447, "transport": "t", "ja3_hash": "0375f3ab06713432eabc8497470c2e7d", "ja3_variant_count": 1, "ja3_variants": [ "0375f3ab06713432eabc8497470c2e7d" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12d150600_8daaf6152771_aba244936733", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150600", "b": "8daaf6152771", "c": "aba244936733", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-27-18-0-10-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790209814, "last_seen": 1790209814, "transport": "t", "ja3_hash": "3df1d618d006952977a90c99fda9e4d1", "ja3_variant_count": 1, "ja3_variants": [ "3df1d618d006952977a90c99fda9e4d1" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d150600_8daaf6152771_aed181237187", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150600", "b": "8daaf6152771", "c": "aed181237187", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-23-11-0-27-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790363143, "last_seen": 1790363143, "transport": "t", "ja3_hash": "aa4a1bbbc2cebf928a0eb3d401c4f23c", "ja3_variant_count": 1, "ja3_variants": [ "aa4a1bbbc2cebf928a0eb3d401c4f23c" ], "user_agents": { "Mozilla/5.0 (Linux; Android 14; 22101316G Build/UP1A.231005.007) AppleWebKit/537.36 (KHTML, like Gecko) Qjqkk/4.0 Chrome/153.0.8010.36 Mobile Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d150600_8daaf6152771_bbfadccc907e", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150600", "b": "8daaf6152771", "c": "bbfadccc907e", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-65037-27-18-0-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790545688, "last_seen": 1790545688, "transport": "t", "ja3_hash": "f9b2f30f847efc76dd95047be64763b4", "ja3_variant_count": 1, "ja3_variants": [ "f9b2f30f847efc76dd95047be64763b4" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d150600_8daaf6152771_c1e96b1d8943", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150600", "b": "8daaf6152771", "c": "c1e96b1d8943", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-13-35-0-5-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791201620, "last_seen": 1791201620, "transport": "t", "ja3_hash": "deb1368dad7fbb08729e491ce6d0d853", "ja3_variant_count": 1, "ja3_variants": [ "deb1368dad7fbb08729e491ce6d0d853" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d150600_8daaf6152771_c2512aed3a54", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150600", "b": "8daaf6152771", "c": "c2512aed3a54", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-0-65281-18-27-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790532633, "last_seen": 1790532633, "transport": "t", "ja3_hash": "41f7875a7e194d4362e4b8263c8292a6", "ja3_variant_count": 1, "ja3_variants": [ "41f7875a7e194d4362e4b8263c8292a6" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d150600_8daaf6152771_c73d23d4a162", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150600", "b": "8daaf6152771", "c": "c73d23d4a162", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-0-17613-65281-10-27,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 27, "name": "compress_certificate", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 2, "first_seen": 1790033876, "last_seen": 1790450742, "transport": "t", "ja3_hash": "b120ef022e010827f1ad080bf059baf2", "ja3_variant_count": 1, "ja3_variants": [ "b120ef022e010827f1ad080bf059baf2" ], "user_agents": { "Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.2245.31 Safari/537.36": 1, "Mozilla/5.0 (Windows NT 6.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/71.0.2475.23 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d150600_8daaf6152771_cfb6e442aef0", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150600", "b": "8daaf6152771", "c": "cfb6e442aef0", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-17613-10-27-0-16,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790729349, "last_seen": 1790729349, "transport": "t", "ja3_hash": "9cf50f12742b525c75da46a577d5d6cf", "ja3_variant_count": 1, "ja3_variants": [ "9cf50f12742b525c75da46a577d5d6cf" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d150600_8daaf6152771_d12977060b85", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150600", "b": "8daaf6152771", "c": "d12977060b85", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-51764-0-11-65037-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789749414, "last_seen": 1789749414, "transport": "t", "ja3_hash": "5d8660ee76362b948b0139ed588c8a8a", "ja3_variant_count": 1, "ja3_variants": [ "5d8660ee76362b948b0139ed588c8a8a" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36": 6 }, "ua_disagreement": false } }, { "hash": "t12d150600_8daaf6152771_d27b5f070ea7", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150600", "b": "8daaf6152771", "c": "d27b5f070ea7", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-23-17613-13-65037-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790561954, "last_seen": 1790561954, "transport": "t", "ja3_hash": "efc15a2a9fe16c2165a7507bf56f7eab", "ja3_variant_count": 1, "ja3_variants": [ "efc15a2a9fe16c2165a7507bf56f7eab" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.1.0 Safari/537.36 Edg/128.1.0": 2 }, "ua_disagreement": false } }, { "hash": "t12d150600_8daaf6152771_d395fd9c24ca", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150600", "b": "8daaf6152771", "c": "d395fd9c24ca", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-5-10-18-65281-51,29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790050286, "last_seen": 1790050286, "transport": "t", "ja3_hash": "3451b7536f77bd2d063eb8d3b1179d69", "ja3_variant_count": 1, "ja3_variants": [ "3451b7536f77bd2d063eb8d3b1179d69" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d150600_8daaf6152771_d94e351cce84", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150600", "b": "8daaf6152771", "c": "d94e351cce84", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-45-65281-51-13-0,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 0, "name": "server_name", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790473290, "last_seen": 1790473290, "transport": "t", "ja3_hash": "3262d68bb96add97e4c19ee76fdd1213", "ja3_variant_count": 1, "ja3_variants": [ "3262d68bb96add97e4c19ee76fdd1213" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36 Edg/153.0.0.0": 5 }, "ua_disagreement": false } }, { "hash": "t12d150600_8daaf6152771_dd2d5343d074", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150600", "b": "8daaf6152771", "c": "dd2d5343d074", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-65037-11-10-18-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791206035, "last_seen": 1791206035, "transport": "t", "ja3_hash": "24972950ba442f1bdd2ff628d41c6a72", "ja3_variant_count": 1, "ja3_variants": [ "24972950ba442f1bdd2ff628d41c6a72" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; https://zhanzhang.toutiao.com/)": 11 }, "ua_disagreement": false } }, { "hash": "t12d150600_8daaf6152771_e4fb48b5b8d3", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150600", "b": "8daaf6152771", "c": "e4fb48b5b8d3", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-23-10-17613-13-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 2, "first_seen": 1790180399, "last_seen": 1790232989, "transport": "t", "ja3_hash": "35dbb3d2ac06fc6fd7063de8b5422aca", "ja3_variant_count": 2, "ja3_variants": [ "35dbb3d2ac06fc6fd7063de8b5422aca", "41723b29e72dcb33a78b47e6c6a995dd" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 2 }, "ua_disagreement": false } }, { "hash": "t12d150600_8daaf6152771_e7d3405fbe96", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150600", "b": "8daaf6152771", "c": "e7d3405fbe96", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-65281-18-45-51-51764,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791050721, "last_seen": 1791050721, "transport": "t", "ja3_hash": "0fde24e3b89e4d20a3aeb5baf37d5081", "ja3_variant_count": 1, "ja3_variants": [ "0fde24e3b89e4d20a3aeb5baf37d5081" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d150600_8daaf6152771_eb18c8aeae74", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150600", "b": "8daaf6152771", "c": "eb18c8aeae74", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-27-0-65037-11-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788659376, "last_seen": 1788659376, "transport": "t", "ja3_hash": "3361ec416f737269143ab8e181f30a49", "ja3_variant_count": 1, "ja3_variants": [ "3361ec416f737269143ab8e181f30a49" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 4 }, "ua_disagreement": false } }, { "hash": "t12d150600_8daaf6152771_ec508e4ddd68", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150600", "b": "8daaf6152771", "c": "ec508e4ddd68", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-65037-0-17613-45-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788800063, "last_seen": 1788800063, "transport": "t", "ja3_hash": "2087d27dde3dcf324a101d426e48f03a", "ja3_variant_count": 1, "ja3_variants": [ "2087d27dde3dcf324a101d426e48f03a" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12d150600_8daaf6152771_ed127436b1ce", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150600", "b": "8daaf6152771", "c": "ed127436b1ce", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-27-0-17513-51-13,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 17513, "name": "application_settings", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791270794, "last_seen": 1791270794, "transport": "t", "ja3_hash": "a0cf557a7346a428ac69a64df0606214", "ja3_variant_count": 1, "ja3_variants": [ "a0cf557a7346a428ac69a64df0606214" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d150600_8daaf6152771_f542b340dfdf", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150600", "b": "8daaf6152771", "c": "f542b340dfdf", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-0-11-51-45-65037,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790271269, "last_seen": 1790271269, "transport": "t", "ja3_hash": "26e080c44eafa37fe9dd2f15e6d2d382", "ja3_variant_count": 1, "ja3_variants": [ "26e080c44eafa37fe9dd2f15e6d2d382" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d150600_8daaf6152771_f6c445a546ae", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150600", "b": "8daaf6152771", "c": "f6c445a546ae", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-23-35-10-11-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789696515, "last_seen": 1789696515, "transport": "t", "ja3_hash": "cf1d02ee053c2af414574151c5703fec", "ja3_variant_count": 1, "ja3_variants": [ "cf1d02ee053c2af414574151c5703fec" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12d150600_8daaf6152771_f92ab96bcf32", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150600", "b": "8daaf6152771", "c": "f92ab96bcf32", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-5-17613-0-10-65281,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790727999, "last_seen": 1790727999, "transport": "t", "ja3_hash": "bdae9a10a11e9c0ce98b87ec4ea12d0d", "ja3_variant_count": 1, "ja3_variants": [ "bdae9a10a11e9c0ce98b87ec4ea12d0d" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.1 Safari/537.36 Edg/134.0.1": 1 }, "ua_disagreement": false } }, { "hash": "t12d150600_8daaf6152771_fca3556a6597", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150600", "b": "8daaf6152771", "c": "fca3556a6597", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-51-17613-11-27-18,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790510997, "last_seen": 1790510997, "transport": "t", "ja3_hash": "d17230078de21d540bf80aa2fb54ae8f", "ja3_variant_count": 1, "ja3_variants": [ "d17230078de21d540bf80aa2fb54ae8f" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d150600_8daaf6152771_fd7701be1c8a", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150600", "b": "8daaf6152771", "c": "fd7701be1c8a", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 6, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-18-23-45-35-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791135129, "last_seen": 1791135129, "transport": "t", "ja3_hash": "5d37f07837a2efb58134fe8292844055", "ja3_variant_count": 1, "ja3_variants": [ "5d37f07837a2efb58134fe8292844055" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d1506h1_8daaf6152771_098fa9ca3a03", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1506h1", "b": "8daaf6152771", "c": "098fa9ca3a03", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 6, "alpn": "h1" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-5-0-51-65281-27,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 27, "name": "compress_certificate", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790547458, "last_seen": 1790547458, "transport": "t", "ja3_hash": "235453b2ae04debb49fad2dd56541a91", "ja3_variant_count": 1, "ja3_variants": [ "235453b2ae04debb49fad2dd56541a91" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d1506h1_8daaf6152771_876aaf23bf8a", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1506h1", "b": "8daaf6152771", "c": "876aaf23bf8a", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 6, "alpn": "h1" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-23-16-13-0-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790994928, "last_seen": 1790994928, "transport": "t", "ja3_hash": "faa3be86de5f5b782967c9f380b5a549", "ja3_variant_count": 1, "ja3_variants": [ "faa3be86de5f5b782967c9f380b5a549" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d1506h2_8daaf6152771_0ae37b1c3827", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1506h2", "b": "8daaf6152771", "c": "0ae37b1c3827", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 6, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-0-10-51-18-65281,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790876543, "last_seen": 1790876543, "transport": "t", "ja3_hash": "23bb35929b83e0a24ce0515e20a67143", "ja3_variant_count": 1, "ja3_variants": [ "23bb35929b83e0a24ce0515e20a67143" ], "user_agents": { "Mozilla/5.0 (Windows NT 11.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0 Safari/537.36 Edg/129.0.0": 1 }, "ua_disagreement": false } }, { "hash": "t12d1506h2_8daaf6152771_17ce3e445b76", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1506h2", "b": "8daaf6152771", "c": "17ce3e445b76", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 6, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-17613-65281-0-10-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791279388, "last_seen": 1791279388, "transport": "t", "ja3_hash": "364edfa1ae5791bc935e133e3ba657cd", "ja3_variant_count": 1, "ja3_variants": [ "364edfa1ae5791bc935e133e3ba657cd" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 10 }, "ua_disagreement": false } }, { "hash": "t12d1506h2_8daaf6152771_3587192c7715", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1506h2", "b": "8daaf6152771", "c": "3587192c7715", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 6, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-16-18-65281-0-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789679729, "last_seen": 1789679729, "transport": "t", "ja3_hash": "91e39face1ca929f3c5e9d2999d57092", "ja3_variant_count": 1, "ja3_variants": [ "91e39face1ca929f3c5e9d2999d57092" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12d1506h2_8daaf6152771_3e3412553152", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1506h2", "b": "8daaf6152771", "c": "3e3412553152", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 6, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-35-18-16-0-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 2, "first_seen": 1789015027, "last_seen": 1790787897, "transport": "t", "ja3_hash": "8f360f4033bf7bb5f3496a7dfdd940a8", "ja3_variant_count": 2, "ja3_variants": [ "8f360f4033bf7bb5f3496a7dfdd940a8", "2c7de40a4d9b44f24f70a77d5a8575f4" ], "user_agents": { "Mozilla/5.0 (iPhone; CPU iPhone OS 15_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/26.5 Mobile/15E148 Safari/604.1": 5 }, "ua_disagreement": false } }, { "hash": "t12d1506h2_8daaf6152771_5394ac5c7199", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1506h2", "b": "8daaf6152771", "c": "5394ac5c7199", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 6, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-10-0-16-65281-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790262346, "last_seen": 1790262346, "transport": "t", "ja3_hash": "b5d28d0b2abc655cbe2d05f3f8aeb501", "ja3_variant_count": 1, "ja3_variants": [ "b5d28d0b2abc655cbe2d05f3f8aeb501" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d1506h2_8daaf6152771_6bbb802afe20", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1506h2", "b": "8daaf6152771", "c": "6bbb802afe20", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 6, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-18-0-23-10-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790783778, "last_seen": 1790783778, "transport": "t", "ja3_hash": "800e752bf45cab4d26df8b359732e3ec", "ja3_variant_count": 1, "ja3_variants": [ "800e752bf45cab4d26df8b359732e3ec" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 10 }, "ua_disagreement": false } }, { "hash": "t12d1506h2_8daaf6152771_7ccb724c0e86", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1506h2", "b": "8daaf6152771", "c": "7ccb724c0e86", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 6, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51764-16-5-0-65037-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791077864, "last_seen": 1791077864, "transport": "t", "ja3_hash": "dc9b3a19a3a4c53e0385b2044bd2b209", "ja3_variant_count": 1, "ja3_variants": [ "dc9b3a19a3a4c53e0385b2044bd2b209" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36": 3 }, "ua_disagreement": false } }, { "hash": "t12d1506h2_8daaf6152771_7d1e362cf368", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1506h2", "b": "8daaf6152771", "c": "7d1e362cf368", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 6, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-16-5-13-0-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789651676, "last_seen": 1789651676, "transport": "t", "ja3_hash": "3be45d555294519c98ef17166a5415ba", "ja3_variant_count": 1, "ja3_variants": [ "3be45d555294519c98ef17166a5415ba" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36 Edg/153.0.0.0": 16 }, "ua_disagreement": false } }, { "hash": "t12d1506h2_8daaf6152771_8a5fa5498eb0", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1506h2", "b": "8daaf6152771", "c": "8a5fa5498eb0", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 6, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-18-0-65037-16-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791106622, "last_seen": 1791106622, "transport": "t", "ja3_hash": "2418c09821e62d2a6f28aa06da3817e7", "ja3_variant_count": 1, "ja3_variants": [ "2418c09821e62d2a6f28aa06da3817e7" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 10 }, "ua_disagreement": false } }, { "hash": "t12d1506h2_8daaf6152771_91b2a3b2a47a", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1506h2", "b": "8daaf6152771", "c": "91b2a3b2a47a", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 6, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-13-0-16-17613-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790229635, "last_seen": 1790229635, "transport": "t", "ja3_hash": "32e5f9c1fea923bb46a0674ee373894f", "ja3_variant_count": 1, "ja3_variants": [ "32e5f9c1fea923bb46a0674ee373894f" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d1506h2_8daaf6152771_98d4d49d6198", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1506h2", "b": "8daaf6152771", "c": "98d4d49d6198", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 6, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-0-10-51-16-11,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 2, "first_seen": 1790876416, "last_seen": 1791135127, "transport": "t", "ja3_hash": "04fe56c428dc155807cedf6c4703b118", "ja3_variant_count": 2, "ja3_variants": [ "04fe56c428dc155807cedf6c4703b118", "d5f220173519a15dc9d927b837a1d805" ], "user_agents": { "Mozilla/5.0 (Windows NT 11.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.1 Safari/537.36 Edg/130.0.1": 1, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36 Edg/136.0.0.0": 1 }, "ua_disagreement": false } }, { "hash": "t12d1506h2_8daaf6152771_b8dbba41e166", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1506h2", "b": "8daaf6152771", "c": "b8dbba41e166", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 6, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-65281-0-13-17613-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790206795, "last_seen": 1790206795, "transport": "t", "ja3_hash": "530d9981deef9e5e76dfcdce54555c44", "ja3_variant_count": 1, "ja3_variants": [ "530d9981deef9e5e76dfcdce54555c44" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d1506h2_8daaf6152771_c68933beeb92", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1506h2", "b": "8daaf6152771", "c": "c68933beeb92", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 6, "alpn": "h2" } }, "ja3_string": "771,4867-4865-4866-52393-52392-49195-49199-49196-49200-49171-49172-156-157-47-53,16-45-0-17613-35-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789843142, "last_seen": 1789843142, "transport": "t", "ja3_hash": "f3404f5e8340b80c6e0d1960f439947b", "ja3_variant_count": 1, "ja3_variants": [ "f3404f5e8340b80c6e0d1960f439947b" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d1506h2_8daaf6152771_ca87df078f5c", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1506h2", "b": "8daaf6152771", "c": "ca87df078f5c", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 6, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-11-0-16-45-43,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 43, "name": "supported_versions", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790209846, "last_seen": 1790209846, "transport": "t", "ja3_hash": "f0f882a028323d87e7c9e9cf7fa5631a", "ja3_variant_count": 1, "ja3_variants": [ "f0f882a028323d87e7c9e9cf7fa5631a" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d1506h2_8daaf6152771_f47d2c2324e1", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1506h2", "b": "8daaf6152771", "c": "f47d2c2324e1", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 6, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-16-5-13-0-65281,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790192695, "last_seen": 1790192695, "transport": "t", "ja3_hash": "bf9f97b10a6d74b5f09a2e12aa62c103", "ja3_variant_count": 1, "ja3_variants": [ "bf9f97b10a6d74b5f09a2e12aa62c103" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d1506h2_8daaf6152771_fadabebf0399", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1506h2", "b": "8daaf6152771", "c": "fadabebf0399", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 6, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-0-17613-18-16-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788770680, "last_seen": 1788770680, "transport": "t", "ja3_hash": "0834d1258bf1b510f21cf35d465b8f23", "ja3_variant_count": 1, "ja3_variants": [ "0834d1258bf1b510f21cf35d465b8f23" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12d1506h2_8daaf6152771_fb68348d6afa", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1506h2", "b": "8daaf6152771", "c": "fb68348d6afa", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 6, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-11-18-0-16-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790373628, "last_seen": 1790373628, "transport": "t", "ja3_hash": "e87922dc8fdb9bd97c8b412b1e0f6908", "ja3_variant_count": 1, "ja3_variants": [ "e87922dc8fdb9bd97c8b412b1e0f6908" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d150700_8daaf6152771_03fd44a0a7ce", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150700", "b": "8daaf6152771", "c": "03fd44a0a7ce", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-0-13-23-65281-18-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791254648, "last_seen": 1791254648, "transport": "t", "ja3_hash": "2f62be6f3e9f50044e07a07b9c08b538", "ja3_variant_count": 1, "ja3_variants": [ "2f62be6f3e9f50044e07a07b9c08b538" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36": 4 }, "ua_disagreement": false } }, { "hash": "t12d150700_8daaf6152771_093e25f1d069", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150700", "b": "8daaf6152771", "c": "093e25f1d069", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-18-45-65037-11-0-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788860432, "last_seen": 1788860432, "transport": "t", "ja3_hash": "2327a888f4cf3c7ba520c975c2a6b93c", "ja3_variant_count": 1, "ja3_variants": [ "2327a888f4cf3c7ba520c975c2a6b93c" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 Edg/152.0.0.0": 1 }, "ua_disagreement": false } }, { "hash": "t12d150700_8daaf6152771_14d1d9209510", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150700", "b": "8daaf6152771", "c": "14d1d9209510", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-17613-65281-35-51-0-65037,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791169152, "last_seen": 1791169152, "transport": "t", "ja3_hash": "0dbfe967ccd79f42061715e3bab9130b", "ja3_variant_count": 1, "ja3_variants": [ "0dbfe967ccd79f42061715e3bab9130b" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 17 }, "ua_disagreement": false } }, { "hash": "t12d150700_8daaf6152771_1ad7dc2d65c8", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150700", "b": "8daaf6152771", "c": "1ad7dc2d65c8", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-51-35-65281-27-0-13,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791072340, "last_seen": 1791072340, "transport": "t", "ja3_hash": "c413d53771adb3524a5b4baf5ed2fc52", "ja3_variant_count": 1, "ja3_variants": [ "c413d53771adb3524a5b4baf5ed2fc52" ], "user_agents": { "Mozilla/5.0 (Linux; Android 15; CPH2653) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Mobile Safari/537.36": 6 }, "ua_disagreement": false } }, { "hash": "t12d150700_8daaf6152771_1c87c2d1602a", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150700", "b": "8daaf6152771", "c": "1c87c2d1602a", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-18-35-0-51-10-13,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790428371, "last_seen": 1790428371, "transport": "t", "ja3_hash": "6c31291e40d26a19b73290fa982dded8", "ja3_variant_count": 1, "ja3_variants": [ "6c31291e40d26a19b73290fa982dded8" ], "user_agents": { "Mozilla/5.0 (Windows NT 11.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.1 Safari/537.36 Edg/134.0.1": 1 }, "ua_disagreement": false } }, { "hash": "t12d150700_8daaf6152771_21a58fe1108f", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150700", "b": "8daaf6152771", "c": "21a58fe1108f", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-45-18-35-13-0-5,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790087033, "last_seen": 1790087033, "transport": "t", "ja3_hash": "fdade459741d1a3d349920bd4cf3c848", "ja3_variant_count": 1, "ja3_variants": [ "fdade459741d1a3d349920bd4cf3c848" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 10 }, "ua_disagreement": false } }, { "hash": "t12d150700_8daaf6152771_2575d2625759", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150700", "b": "8daaf6152771", "c": "2575d2625759", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-13-35-11-10-0-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790959669, "last_seen": 1790959669, "transport": "t", "ja3_hash": "ad73581300b9b05209f41229088875bb", "ja3_variant_count": 1, "ja3_variants": [ "ad73581300b9b05209f41229088875bb" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36 Edg/136.0.0.0": 1 }, "ua_disagreement": false } }, { "hash": "t12d150700_8daaf6152771_260fa694077d", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150700", "b": "8daaf6152771", "c": "260fa694077d", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51764-5-0-10-11-45-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 5, "name": "status_request", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788899815, "last_seen": 1788899815, "transport": "t", "ja3_hash": "2e199067cec85c54750b35536b6ab30b", "ja3_variant_count": 1, "ja3_variants": [ "2e199067cec85c54750b35536b6ab30b" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d150700_8daaf6152771_2e7a4dd14f7b", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150700", "b": "8daaf6152771", "c": "2e7a4dd14f7b", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-65281-27-65037-0-18-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790526827, "last_seen": 1790526827, "transport": "t", "ja3_hash": "dad8ef520c9f6b3cd5ad13825f368543", "ja3_variant_count": 1, "ja3_variants": [ "dad8ef520c9f6b3cd5ad13825f368543" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d150700_8daaf6152771_31421bbacb54", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150700", "b": "8daaf6152771", "c": "31421bbacb54", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-13-18-0-5-35-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790540584, "last_seen": 1790540584, "transport": "t", "ja3_hash": "810e29c0bacaf284cbff5d1b2447ecc5", "ja3_variant_count": 1, "ja3_variants": [ "810e29c0bacaf284cbff5d1b2447ecc5" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 10 }, "ua_disagreement": false } }, { "hash": "t12d150700_8daaf6152771_34271d4b9f54", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150700", "b": "8daaf6152771", "c": "34271d4b9f54", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-10-23-45-0-13-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790730244, "last_seen": 1790730244, "transport": "t", "ja3_hash": "52751b34b7cd35f2ea2983fd46b95ca9", "ja3_variant_count": 1, "ja3_variants": [ "52751b34b7cd35f2ea2983fd46b95ca9" ], "user_agents": { "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d150700_8daaf6152771_36262a6667bf", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150700", "b": "8daaf6152771", "c": "36262a6667bf", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-0-10-17613-51-18-16,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790240400, "last_seen": 1790240400, "transport": "t", "ja3_hash": "d1bb674ab0304400ca39faf33d58423c", "ja3_variant_count": 1, "ja3_variants": [ "d1bb674ab0304400ca39faf33d58423c" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d150700_8daaf6152771_37d4aa0cacb3", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150700", "b": "8daaf6152771", "c": "37d4aa0cacb3", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-10-51-45-18-23-11,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790202824, "last_seen": 1790202824, "transport": "t", "ja3_hash": "ad7c653990e855b680de83745859ee12", "ja3_variant_count": 1, "ja3_variants": [ "ad7c653990e855b680de83745859ee12" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d150700_8daaf6152771_3c6d38aac917", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150700", "b": "8daaf6152771", "c": "3c6d38aac917", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-35-0-27-13-10-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791302752, "last_seen": 1791302752, "transport": "t", "ja3_hash": "63b9dec2b660ec5c65bfe4f86f7280e1", "ja3_variant_count": 1, "ja3_variants": [ "63b9dec2b660ec5c65bfe4f86f7280e1" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36 Edg/154.0.0.0": 22 }, "ua_disagreement": false } }, { "hash": "t12d150700_8daaf6152771_3ca074dce651", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150700", "b": "8daaf6152771", "c": "3ca074dce651", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-0-10-65281-18-27-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791230875, "last_seen": 1791230875, "transport": "t", "ja3_hash": "3d946477f5b0c8d80383d1eecc23359f", "ja3_variant_count": 1, "ja3_variants": [ "3d946477f5b0c8d80383d1eecc23359f" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d150700_8daaf6152771_3e9928a3d8b5", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150700", "b": "8daaf6152771", "c": "3e9928a3d8b5", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-65037-0-10-11-18-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790036569, "last_seen": 1790036569, "transport": "t", "ja3_hash": "397d6e9f1e3e5162d25d02a442a4f9de", "ja3_variant_count": 1, "ja3_variants": [ "397d6e9f1e3e5162d25d02a442a4f9de" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 12 }, "ua_disagreement": false } }, { "hash": "t12d150700_8daaf6152771_43a60159589f", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150700", "b": "8daaf6152771", "c": "43a60159589f", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-5-0-11-27-10-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790433302, "last_seen": 1790433302, "transport": "t", "ja3_hash": "a708353fb46a5992c3a9ca9390226d80", "ja3_variant_count": 1, "ja3_variants": [ "a708353fb46a5992c3a9ca9390226d80" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d150700_8daaf6152771_43e9858415ab", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150700", "b": "8daaf6152771", "c": "43e9858415ab", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-51764-10-27-11-45-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790713376, "last_seen": 1790713376, "transport": "t", "ja3_hash": "18615e3fbacd2cc65eab3ddf7b6bab77", "ja3_variant_count": 1, "ja3_variants": [ "18615e3fbacd2cc65eab3ddf7b6bab77" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36": 30 }, "ua_disagreement": false } }, { "hash": "t12d150700_8daaf6152771_463b40f2ca00", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150700", "b": "8daaf6152771", "c": "463b40f2ca00", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-27-5-11-65281-45-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790538734, "last_seen": 1790538734, "transport": "t", "ja3_hash": "c5ce721af758851e0ae98500ecbe98d8", "ja3_variant_count": 1, "ja3_variants": [ "c5ce721af758851e0ae98500ecbe98d8" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d150700_8daaf6152771_4680b51460e1", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150700", "b": "8daaf6152771", "c": "4680b51460e1", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-51-0-35-17613-11-18,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788786718, "last_seen": 1788786718, "transport": "t", "ja3_hash": "21511692f7f94d0d46b64aac7a26c09c", "ja3_variant_count": 1, "ja3_variants": [ "21511692f7f94d0d46b64aac7a26c09c" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12d150700_8daaf6152771_4694f670452b", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150700", "b": "8daaf6152771", "c": "4694f670452b", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-51-23-10-17613-0-51764,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 0, "name": "server_name", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791094115, "last_seen": 1791094115, "transport": "t", "ja3_hash": "d4b94705eb4d088622fbb884aca0f3ac", "ja3_variant_count": 1, "ja3_variants": [ "d4b94705eb4d088622fbb884aca0f3ac" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d150700_8daaf6152771_49aace187330", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150700", "b": "8daaf6152771", "c": "49aace187330", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-5-0-65037-10-65281-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789686911, "last_seen": 1789686911, "transport": "t", "ja3_hash": "5868a88e4bf594d9147f01b2fed62357", "ja3_variant_count": 1, "ja3_variants": [ "5868a88e4bf594d9147f01b2fed62357" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12d150700_8daaf6152771_4b100164aca0", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150700", "b": "8daaf6152771", "c": "4b100164aca0", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-45-0-65281-11-18-27,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 27, "name": "compress_certificate", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790744200, "last_seen": 1790744200, "transport": "t", "ja3_hash": "7b0c1b8751908541f2034588845ba382", "ja3_variant_count": 1, "ja3_variants": [ "7b0c1b8751908541f2034588845ba382" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 10 }, "ua_disagreement": false } }, { "hash": "t12d150700_8daaf6152771_4d1d91cea757", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150700", "b": "8daaf6152771", "c": "4d1d91cea757", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-0-17613-65281-10-27-35,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 35, "name": "session_ticket", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 2, "first_seen": 1790370190, "last_seen": 1790802425, "transport": "t", "ja3_hash": "338f6e09a90c18f7108a5b5ba865b13b", "ja3_variant_count": 1, "ja3_variants": [ "338f6e09a90c18f7108a5b5ba865b13b" ], "user_agents": { "Mozilla/5.0 (Windows NT 6.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3418.123 Safari/537.36": 1, "Mozilla/5.0 (Windows NT 6.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/68.0.2697.15 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d150700_8daaf6152771_502d61787738", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150700", "b": "8daaf6152771", "c": "502d61787738", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-27-23-35-0-5-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788961093, "last_seen": 1788961093, "transport": "t", "ja3_hash": "b77021b04cf5b250bd196b0089b3cf13", "ja3_variant_count": 1, "ja3_variants": [ "b77021b04cf5b250bd196b0089b3cf13" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 Edg/152.0.0.0": 2 }, "ua_disagreement": false } }, { "hash": "t12d150700_8daaf6152771_554d1ebbfc2d", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150700", "b": "8daaf6152771", "c": "554d1ebbfc2d", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-51-17613-35-27-10-43,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 43, "name": "supported_versions", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791269962, "last_seen": 1791269962, "transport": "t", "ja3_hash": "59aab205857ebe3959ff1203fef04ce4", "ja3_variant_count": 1, "ja3_variants": [ "59aab205857ebe3959ff1203fef04ce4" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 10 }, "ua_disagreement": false } }, { "hash": "t12d150700_8daaf6152771_564ef60b0578", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150700", "b": "8daaf6152771", "c": "564ef60b0578", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-18-0-45-5-35-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789028199, "last_seen": 1789028199, "transport": "t", "ja3_hash": "6ef12ae1bd6584f14ac4ab4e35ee1a26", "ja3_variant_count": 1, "ja3_variants": [ "6ef12ae1bd6584f14ac4ab4e35ee1a26" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d150700_8daaf6152771_596a89a2c4a6", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150700", "b": "8daaf6152771", "c": "596a89a2c4a6", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-13-51764-45-27-0-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789711535, "last_seen": 1789711535, "transport": "t", "ja3_hash": "55278dadc49e6af7f0fab456df564626", "ja3_variant_count": 1, "ja3_variants": [ "55278dadc49e6af7f0fab456df564626" ], "user_agents": { "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d150700_8daaf6152771_5d25a6bf1c15", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150700", "b": "8daaf6152771", "c": "5d25a6bf1c15", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-45-10-0-23-11-51,25497-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 25497, "name": "X25519Kyber768Draft00", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790539658, "last_seen": 1790539658, "transport": "t", "ja3_hash": "8dee48ff131c1dc9f731bfb86946a18f", "ja3_variant_count": 1, "ja3_variants": [ "8dee48ff131c1dc9f731bfb86946a18f" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d150700_8daaf6152771_61b783a2551e", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150700", "b": "8daaf6152771", "c": "61b783a2551e", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-65281-17613-5-0-45-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 5, "name": "status_request", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788932412, "last_seen": 1788932412, "transport": "t", "ja3_hash": "96c1b0fea7d5913c1c064feab28e745e", "ja3_variant_count": 1, "ja3_variants": [ "96c1b0fea7d5913c1c064feab28e745e" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 2 }, "ua_disagreement": false } }, { "hash": "t12d150700_8daaf6152771_72582d5558dd", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150700", "b": "8daaf6152771", "c": "72582d5558dd", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-23-11-35-13-0-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790240535, "last_seen": 1790240535, "transport": "t", "ja3_hash": "f512c2e840bc5617c854a5d51129c1ff", "ja3_variant_count": 1, "ja3_variants": [ "f512c2e840bc5617c854a5d51129c1ff" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d150700_8daaf6152771_756b94b069b6", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150700", "b": "8daaf6152771", "c": "756b94b069b6", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-0-10-45-23-11-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788784608, "last_seen": 1788784608, "transport": "t", "ja3_hash": "478da8c982d2170b9efac950908a311f", "ja3_variant_count": 1, "ja3_variants": [ "478da8c982d2170b9efac950908a311f" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12d150700_8daaf6152771_806e1127c62c", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150700", "b": "8daaf6152771", "c": "806e1127c62c", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-51-0-5-27-17613-65281,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789131927, "last_seen": 1789131927, "transport": "t", "ja3_hash": "330721dc587bfb6106452142e92db1a7", "ja3_variant_count": 1, "ja3_variants": [ "330721dc587bfb6106452142e92db1a7" ], "user_agents": { "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 15 }, "ua_disagreement": false } }, { "hash": "t12d150700_8daaf6152771_8b60e773ed0d", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150700", "b": "8daaf6152771", "c": "8b60e773ed0d", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-13-10-23-27-0-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791110251, "last_seen": 1791110251, "transport": "t", "ja3_hash": "02088bb295d3eff458b647860338547d", "ja3_variant_count": 1, "ja3_variants": [ "02088bb295d3eff458b647860338547d" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 10 }, "ua_disagreement": false } }, { "hash": "t12d150700_8daaf6152771_95964e8544f9", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150700", "b": "8daaf6152771", "c": "95964e8544f9", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-45-23-0-27-65037-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790258031, "last_seen": 1790258031, "transport": "t", "ja3_hash": "e4f3f86dcf293983371bfe703ef171e4", "ja3_variant_count": 1, "ja3_variants": [ "e4f3f86dcf293983371bfe703ef171e4" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d150700_8daaf6152771_9f5af1b6fc8d", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150700", "b": "8daaf6152771", "c": "9f5af1b6fc8d", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-65037-13-10-0-18-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788882156, "last_seen": 1788882156, "transport": "t", "ja3_hash": "404a9c15c19debcefc712694aa6748ab", "ja3_variant_count": 1, "ja3_variants": [ "404a9c15c19debcefc712694aa6748ab" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d150700_8daaf6152771_a87cb9b3e7e2", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150700", "b": "8daaf6152771", "c": "a87cb9b3e7e2", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-23-35-0-51-65281-13,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791150189, "last_seen": 1791150189, "transport": "t", "ja3_hash": "de986cba06d8f17ece81f735793738ab", "ja3_variant_count": 1, "ja3_variants": [ "de986cba06d8f17ece81f735793738ab" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 10 }, "ua_disagreement": false } }, { "hash": "t12d150700_8daaf6152771_ab6af1c9e879", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150700", "b": "8daaf6152771", "c": "ab6af1c9e879", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-45-27-65037-23-0-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790470779, "last_seen": 1790470779, "transport": "t", "ja3_hash": "8abc9a5b9338c1d3cb00a92090ea687c", "ja3_variant_count": 1, "ja3_variants": [ "8abc9a5b9338c1d3cb00a92090ea687c" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 10 }, "ua_disagreement": false } }, { "hash": "t12d150700_8daaf6152771_af2808cf11fe", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150700", "b": "8daaf6152771", "c": "af2808cf11fe", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-10-17613-45-65281-11-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 2, "first_seen": 1788839892, "last_seen": 1790915129, "transport": "t", "ja3_hash": "915a4eb939676164e830bf366e8a8598", "ja3_variant_count": 2, "ja3_variants": [ "915a4eb939676164e830bf366e8a8598", "d0849de6bf6e5fa8a14b21a0ebad7fca" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36 Edg/154.0.0.0": 60, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 12 }, "ua_disagreement": false } }, { "hash": "t12d150700_8daaf6152771_b15fef1fd057", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150700", "b": "8daaf6152771", "c": "b15fef1fd057", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-35-45-27-51764-65037-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789656399, "last_seen": 1789656399, "transport": "t", "ja3_hash": "0ea2510d38043440452039774ed7812a", "ja3_variant_count": 1, "ja3_variants": [ "0ea2510d38043440452039774ed7812a" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d150700_8daaf6152771_b3ae74ed7d49", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150700", "b": "8daaf6152771", "c": "b3ae74ed7d49", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-23-0-17613-51764-45-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790686995, "last_seen": 1790686995, "transport": "t", "ja3_hash": "295b1cdb539bc7ea3548e0d93f0da013", "ja3_variant_count": 1, "ja3_variants": [ "295b1cdb539bc7ea3548e0d93f0da013" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36": 6 }, "ua_disagreement": false } }, { "hash": "t12d150700_8daaf6152771_b56ede2f9183", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150700", "b": "8daaf6152771", "c": "b56ede2f9183", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-13-65037-35-4832-45-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 4832, "name": "4832 (0x12e0)", "known": false }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790063271, "last_seen": 1790063271, "transport": "t", "ja3_hash": "f62d8ef7e608aacf26a32325ae1582b2", "ja3_variant_count": 1, "ja3_variants": [ "f62d8ef7e608aacf26a32325ae1582b2" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 13 }, "ua_disagreement": false } }, { "hash": "t12d150700_8daaf6152771_b8cf28bda7f1", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150700", "b": "8daaf6152771", "c": "b8cf28bda7f1", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-11-23-13-5-0-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790208964, "last_seen": 1790208964, "transport": "t", "ja3_hash": "ba8e3b786ab6d56ba19f0f6712b3bb68", "ja3_variant_count": 1, "ja3_variants": [ "ba8e3b786ab6d56ba19f0f6712b3bb68" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d150700_8daaf6152771_ba847aecabc2", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150700", "b": "8daaf6152771", "c": "ba847aecabc2", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-10-23-5-45-0-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791077854, "last_seen": 1791077854, "transport": "t", "ja3_hash": "6cde91f6fecf69c29eac733a28d2b27b", "ja3_variant_count": 1, "ja3_variants": [ "6cde91f6fecf69c29eac733a28d2b27b" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36": 15 }, "ua_disagreement": false } }, { "hash": "t12d150700_8daaf6152771_bd6bcb70713c", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150700", "b": "8daaf6152771", "c": "bd6bcb70713c", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-0-18-10-27-17613-35,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 35, "name": "session_ticket", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788634782, "last_seen": 1788634782, "transport": "t", "ja3_hash": "d48421a0e38edc8f9f5a5974836f2b26", "ja3_variant_count": 1, "ja3_variants": [ "d48421a0e38edc8f9f5a5974836f2b26" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12d150700_8daaf6152771_c116284cb0c9", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150700", "b": "8daaf6152771", "c": "c116284cb0c9", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-0-23-17613-11-51764-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791111903, "last_seen": 1791111903, "transport": "t", "ja3_hash": "92c9c8665be867311b479235e4fdc158", "ja3_variant_count": 1, "ja3_variants": [ "92c9c8665be867311b479235e4fdc158" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 7 }, "ua_disagreement": false } }, { "hash": "t12d150700_8daaf6152771_c330208a4152", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150700", "b": "8daaf6152771", "c": "c330208a4152", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-18-10-27-65037-0-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789457561, "last_seen": 1789457561, "transport": "t", "ja3_hash": "47a74b02e799641e8c468d31e97993b7", "ja3_variant_count": 1, "ja3_variants": [ "47a74b02e799641e8c468d31e97993b7" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36": 4 }, "ua_disagreement": false } }, { "hash": "t12d150700_8daaf6152771_c5a699d23716", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150700", "b": "8daaf6152771", "c": "c5a699d23716", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-51-45-0-11-13-27,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 27, "name": "compress_certificate", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790433810, "last_seen": 1790433810, "transport": "t", "ja3_hash": "223d9612f4b902110ec666712668d3ad", "ja3_variant_count": 1, "ja3_variants": [ "223d9612f4b902110ec666712668d3ad" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d150700_8daaf6152771_c5f41a72b514", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150700", "b": "8daaf6152771", "c": "c5f41a72b514", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-0-45-5-18-51-65281,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790650648, "last_seen": 1790650648, "transport": "t", "ja3_hash": "9a9aea74df4b65f834ed4796e6329fe4", "ja3_variant_count": 1, "ja3_variants": [ "9a9aea74df4b65f834ed4796e6329fe4" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d150700_8daaf6152771_c704c55a63fa", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150700", "b": "8daaf6152771", "c": "c704c55a63fa", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-45-0-35-65281-65037-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790166991, "last_seen": 1790166991, "transport": "t", "ja3_hash": "bc46b040b582b52139dbb25486f86d47", "ja3_variant_count": 1, "ja3_variants": [ "bc46b040b582b52139dbb25486f86d47" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 10 }, "ua_disagreement": false } }, { "hash": "t12d150700_8daaf6152771_cc884e4155a1", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150700", "b": "8daaf6152771", "c": "cc884e4155a1", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-0-10-23-45-35-65281,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790224725, "last_seen": 1790224725, "transport": "t", "ja3_hash": "2bd53dbaf025acfff878b0f9db4c2047", "ja3_variant_count": 1, "ja3_variants": [ "2bd53dbaf025acfff878b0f9db4c2047" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d150700_8daaf6152771_d1e038da55b7", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150700", "b": "8daaf6152771", "c": "d1e038da55b7", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-35-45-0-13-11-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789747127, "last_seen": 1789747127, "transport": "t", "ja3_hash": "d4bde206f575d544e8233f30ae3e1be9", "ja3_variant_count": 1, "ja3_variants": [ "d4bde206f575d544e8233f30ae3e1be9" ], "user_agents": { "Mozilla/5.0 (iPhone; CPU iPhone OS 26_6_2 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/153.0.8010.24 Mobile/15E148 Safari/604.1": 1 }, "ua_disagreement": false } }, { "hash": "t12d150700_8daaf6152771_d2e9457c634f", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150700", "b": "8daaf6152771", "c": "d2e9457c634f", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-13-0-11-5-18-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791032233, "last_seen": 1791032233, "transport": "t", "ja3_hash": "eae72df705a9569c3fa1b2fb8c521395", "ja3_variant_count": 1, "ja3_variants": [ "eae72df705a9569c3fa1b2fb8c521395" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36": 2 }, "ua_disagreement": false } }, { "hash": "t12d150700_8daaf6152771_d4a721918ff5", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150700", "b": "8daaf6152771", "c": "d4a721918ff5", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-51-17513-13-0-18-11,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 17513, "name": "application_settings", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790942439, "last_seen": 1790942439, "transport": "t", "ja3_hash": "d2ae0013263c942b38a46e43c08d6e6e", "ja3_variant_count": 1, "ja3_variants": [ "d2ae0013263c942b38a46e43c08d6e6e" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d150700_8daaf6152771_e13542d9dc06", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150700", "b": "8daaf6152771", "c": "e13542d9dc06", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-10-51-27-17613-0-45,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 0, "name": "server_name", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789048594, "last_seen": 1789048594, "transport": "t", "ja3_hash": "f3c3c1aa40ebb010fc01b29a4388382a", "ja3_variant_count": 1, "ja3_variants": [ "f3c3c1aa40ebb010fc01b29a4388382a" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 8 }, "ua_disagreement": false } }, { "hash": "t12d150700_8daaf6152771_e563932f5797", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150700", "b": "8daaf6152771", "c": "e563932f5797", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-65281-18-17613-27-0-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789694807, "last_seen": 1789694807, "transport": "t", "ja3_hash": "331b5c461429e36f4144b36d34475e9e", "ja3_variant_count": 1, "ja3_variants": [ "331b5c461429e36f4144b36d34475e9e" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12d150700_8daaf6152771_e8707c638f34", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150700", "b": "8daaf6152771", "c": "e8707c638f34", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-5-23-0-11-18-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 2, "first_seen": 1788745811, "last_seen": 1790212301, "transport": "t", "ja3_hash": "c2e19fed91d63cd18083f5593ac1218f", "ja3_variant_count": 2, "ja3_variants": [ "c2e19fed91d63cd18083f5593ac1218f", "a18fe54babf180e6a25bd06ed3d010c5" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 1, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d150700_8daaf6152771_e8eb4d10413c", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150700", "b": "8daaf6152771", "c": "e8eb4d10413c", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-10-65281-51-11-45-0,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 0, "name": "server_name", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791175122, "last_seen": 1791175122, "transport": "t", "ja3_hash": "de47a18092f1a084bdf450804c02eb37", "ja3_variant_count": 1, "ja3_variants": [ "de47a18092f1a084bdf450804c02eb37" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 10 }, "ua_disagreement": false } }, { "hash": "t12d150700_8daaf6152771_ea1c4b16555e", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150700", "b": "8daaf6152771", "c": "ea1c4b16555e", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-11-5-0-13-27-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790997345, "last_seen": 1790997345, "transport": "t", "ja3_hash": "7b7231421733423b3f58c80a20c2edc7", "ja3_variant_count": 1, "ja3_variants": [ "7b7231421733423b3f58c80a20c2edc7" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d150700_8daaf6152771_ec328da8d33a", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150700", "b": "8daaf6152771", "c": "ec328da8d33a", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-0-10-18-23-17613-65037,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790243622, "last_seen": 1790243622, "transport": "t", "ja3_hash": "d33e91c23ab84ea525e74a84150b2ed6", "ja3_variant_count": 1, "ja3_variants": [ "d33e91c23ab84ea525e74a84150b2ed6" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d150700_8daaf6152771_f1094dff5af0", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150700", "b": "8daaf6152771", "c": "f1094dff5af0", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-51-13-0-27-11-65037,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790654598, "last_seen": 1790654598, "transport": "t", "ja3_hash": "a29b94b20ddad1905501d5cca00e4b1e", "ja3_variant_count": 1, "ja3_variants": [ "a29b94b20ddad1905501d5cca00e4b1e" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 6 }, "ua_disagreement": false } }, { "hash": "t12d150700_8daaf6152771_f3cd1db5c541", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150700", "b": "8daaf6152771", "c": "f3cd1db5c541", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-5-18-0-11-45-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790615340, "last_seen": 1790615340, "transport": "t", "ja3_hash": "c6cc3c8560a00019c96187c2ff454884", "ja3_variant_count": 1, "ja3_variants": [ "c6cc3c8560a00019c96187c2ff454884" ], "user_agents": { "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d150700_8daaf6152771_f6e3689e1b9b", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150700", "b": "8daaf6152771", "c": "f6e3689e1b9b", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-0-13-65037-10-27-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790241416, "last_seen": 1790241416, "transport": "t", "ja3_hash": "ead943fab78016ab021aa66464b9df95", "ja3_variant_count": 1, "ja3_variants": [ "ead943fab78016ab021aa66464b9df95" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d150700_8daaf6152771_f983c1361f15", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150700", "b": "8daaf6152771", "c": "f983c1361f15", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-35-10-45-65037-17613-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791091031, "last_seen": 1791091031, "transport": "t", "ja3_hash": "d171eaad5654497bb343792c5aa7ab1b", "ja3_variant_count": 1, "ja3_variants": [ "d171eaad5654497bb343792c5aa7ab1b" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 10 }, "ua_disagreement": false } }, { "hash": "t12d150700_8daaf6152771_fa036ecbfa13", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150700", "b": "8daaf6152771", "c": "fa036ecbfa13", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 7, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-5-65037-35-0-13-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790241004, "last_seen": 1790241004, "transport": "t", "ja3_hash": "43615eca95c8b8ff5cc8d771aebf0953", "ja3_variant_count": 1, "ja3_variants": [ "43615eca95c8b8ff5cc8d771aebf0953" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d1507h1_8daaf6152771_7e74fe43ae60", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1507h1", "b": "8daaf6152771", "c": "7e74fe43ae60", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 7, "alpn": "h1" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-35-0-10-13-16-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791200428, "last_seen": 1791200428, "transport": "t", "ja3_hash": "d47c934c4ddfa64546383a4add51e1c7", "ja3_variant_count": 1, "ja3_variants": [ "d47c934c4ddfa64546383a4add51e1c7" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d1507h1_8daaf6152771_f55e6fd5b343", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1507h1", "b": "8daaf6152771", "c": "f55e6fd5b343", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 7, "alpn": "h1" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-16-5-45-51-0-65281,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790526157, "last_seen": 1790526157, "transport": "t", "ja3_hash": "70b7af7832ce6191fa23b38c805e0903", "ja3_variant_count": 1, "ja3_variants": [ "70b7af7832ce6191fa23b38c805e0903" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d1507h2_8daaf6152771_115d5d4d0596", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1507h2", "b": "8daaf6152771", "c": "115d5d4d0596", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 7, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-10-16-5-23-45-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789647902, "last_seen": 1789647902, "transport": "t", "ja3_hash": "839d98a6397e48fe7677d885008dbd2c", "ja3_variant_count": 1, "ja3_variants": [ "839d98a6397e48fe7677d885008dbd2c" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 90 }, "ua_disagreement": false } }, { "hash": "t12d1507h2_8daaf6152771_125b5db86202", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1507h2", "b": "8daaf6152771", "c": "125b5db86202", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 7, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-18-16-23-51-10-0,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790697101, "last_seen": 1790697101, "transport": "t", "ja3_hash": "9b4170cd01a69530932a0079a3ab5456", "ja3_variant_count": 1, "ja3_variants": [ "9b4170cd01a69530932a0079a3ab5456" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36 Edg/153.0.0.0": 61 }, "ua_disagreement": false } }, { "hash": "t12d1507h2_8daaf6152771_1298b609779b", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1507h2", "b": "8daaf6152771", "c": "1298b609779b", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 7, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-13-65037-0-35-45-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789024337, "last_seen": 1789024337, "transport": "t", "ja3_hash": "ccdfe6823c99dcdfe5f7d32972d8c3e2", "ja3_variant_count": 1, "ja3_variants": [ "ccdfe6823c99dcdfe5f7d32972d8c3e2" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36 Edg/151.0.0.0": 16 }, "ua_disagreement": false } }, { "hash": "t12d1507h2_8daaf6152771_130693274701", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1507h2", "b": "8daaf6152771", "c": "130693274701", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 7, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-10-16-0-65037-35-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789776176, "last_seen": 1789776176, "transport": "t", "ja3_hash": "3c069d1f3dbb9a2f478e544fbd2f861f", "ja3_variant_count": 1, "ja3_variants": [ "3c069d1f3dbb9a2f478e544fbd2f861f" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36 Edg/135.0.0.0": 33 }, "ua_disagreement": false } }, { "hash": "t12d1507h2_8daaf6152771_1dca2383d6a6", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1507h2", "b": "8daaf6152771", "c": "1dca2383d6a6", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 7, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-16-11-13-0-18-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789746713, "last_seen": 1789746713, "transport": "t", "ja3_hash": "bca7b20391f889649a643139d98ad297", "ja3_variant_count": 1, "ja3_variants": [ "bca7b20391f889649a643139d98ad297" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12d1507h2_8daaf6152771_1ed02fa9d6a7", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1507h2", "b": "8daaf6152771", "c": "1ed02fa9d6a7", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 7, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-16-18-35-23-0-11,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790213604, "last_seen": 1790213604, "transport": "t", "ja3_hash": "b0a7dc9a1e9d86d13d3b4e4bebd61395", "ja3_variant_count": 1, "ja3_variants": [ "b0a7dc9a1e9d86d13d3b4e4bebd61395" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d1507h2_8daaf6152771_2ecc24af6944", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1507h2", "b": "8daaf6152771", "c": "2ecc24af6944", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 7, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-23-0-65281-16-65037-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790207874, "last_seen": 1790207874, "transport": "t", "ja3_hash": "6f9dbb831fef52e6f1490dc647e851e1", "ja3_variant_count": 1, "ja3_variants": [ "6f9dbb831fef52e6f1490dc647e851e1" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d1507h2_8daaf6152771_35cddba6e7d1", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1507h2", "b": "8daaf6152771", "c": "35cddba6e7d1", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 7, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-65281-16-11-10-35-51,25497-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 25497, "name": "X25519Kyber768Draft00", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790668677, "last_seen": 1790668677, "transport": "t", "ja3_hash": "bde636390146debcdab66be3abed1a04", "ja3_variant_count": 1, "ja3_variants": [ "bde636390146debcdab66be3abed1a04" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d1507h2_8daaf6152771_38ad60c601f2", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1507h2", "b": "8daaf6152771", "c": "38ad60c601f2", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 7, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-5-65281-0-27-16-13,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791144636, "last_seen": 1791144636, "transport": "t", "ja3_hash": "9143f9c3c5303edb34fb72f3a2d04691", "ja3_variant_count": 1, "ja3_variants": [ "9143f9c3c5303edb34fb72f3a2d04691" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.1.0 Safari/537.36 Edg/130.1.0": 1 }, "ua_disagreement": false } }, { "hash": "t12d1507h2_8daaf6152771_3f958b09e6c5", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1507h2", "b": "8daaf6152771", "c": "3f958b09e6c5", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 7, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-35-0-5-65037-16-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790729442, "last_seen": 1790729442, "transport": "t", "ja3_hash": "6163d7db66971f73d8dd49a7f861d10e", "ja3_variant_count": 1, "ja3_variants": [ "6163d7db66971f73d8dd49a7f861d10e" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d1507h2_8daaf6152771_4c6668cd1174", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1507h2", "b": "8daaf6152771", "c": "4c6668cd1174", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 7, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-10-51764-23-0-16-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789737280, "last_seen": 1789737280, "transport": "t", "ja3_hash": "ccbd6c9decd8d561220bbeede877484a", "ja3_variant_count": 1, "ja3_variants": [ "ccbd6c9decd8d561220bbeede877484a" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d1507h2_8daaf6152771_5d062003f518", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1507h2", "b": "8daaf6152771", "c": "5d062003f518", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 7, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-35-17613-16-27-65281-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790588089, "last_seen": 1790588089, "transport": "t", "ja3_hash": "c700be17255d64f996a3eea75663d7e3", "ja3_variant_count": 1, "ja3_variants": [ "c700be17255d64f996a3eea75663d7e3" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36 Edg/154.0.0.0": 13 }, "ua_disagreement": false } }, { "hash": "t12d1507h2_8daaf6152771_5deea1d9b0b7", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1507h2", "b": "8daaf6152771", "c": "5deea1d9b0b7", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 7, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-51-45-17613-0-23-16,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 2, "first_seen": 1788979953, "last_seen": 1789516969, "transport": "t", "ja3_hash": "db7ff95d7beb81bbcc44eee9cf746bb6", "ja3_variant_count": 2, "ja3_variants": [ "db7ff95d7beb81bbcc44eee9cf746bb6", "a18796f9b0c25f8f7cb554593633841d" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 2, "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 15 }, "ua_disagreement": false } }, { "hash": "t12d1507h2_8daaf6152771_5fda1207da30", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1507h2", "b": "8daaf6152771", "c": "5fda1207da30", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 7, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-27-0-45-16-18-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790738521, "last_seen": 1790738521, "transport": "t", "ja3_hash": "406831d42f8a7a9bf5e2c240cce093e4", "ja3_variant_count": 1, "ja3_variants": [ "406831d42f8a7a9bf5e2c240cce093e4" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 10 }, "ua_disagreement": false } }, { "hash": "t12d1507h2_8daaf6152771_736e2dd1c234", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1507h2", "b": "8daaf6152771", "c": "736e2dd1c234", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 7, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-51-17613-35-16-45-18,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788460001, "last_seen": 1788460001, "transport": "t", "ja3_hash": "1a896bc34249e4709a9edb361a9dd396", "ja3_variant_count": 1, "ja3_variants": [ "1a896bc34249e4709a9edb361a9dd396" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 Edg/152.0.0.0": 2 }, "ua_disagreement": false } }, { "hash": "t12d1507h2_8daaf6152771_747673b6b315", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1507h2", "b": "8daaf6152771", "c": "747673b6b315", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 7, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-16-5-18-27-23-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789902631, "last_seen": 1789902631, "transport": "t", "ja3_hash": "2a43cbbc8cfad4c3b677ed17f0da2b15", "ja3_variant_count": 1, "ja3_variants": [ "2a43cbbc8cfad4c3b677ed17f0da2b15" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d1507h2_8daaf6152771_8ac39a44b638", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1507h2", "b": "8daaf6152771", "c": "8ac39a44b638", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 7, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-0-27-51-5-11-18,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 2, "first_seen": 1790333602, "last_seen": 1790333603, "transport": "t", "ja3_hash": "89baa2393f09fd31759efb221770ceaf", "ja3_variant_count": 1, "ja3_variants": [ "89baa2393f09fd31759efb221770ceaf" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36": 2 }, "ua_disagreement": false } }, { "hash": "t12d1507h2_8daaf6152771_9e6f74212d64", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1507h2", "b": "8daaf6152771", "c": "9e6f74212d64", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 7, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-0-11-16-45-65281-65037,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789684459, "last_seen": 1789684459, "transport": "t", "ja3_hash": "8b2f156a10ffba310a544f9a6158e839", "ja3_variant_count": 1, "ja3_variants": [ "8b2f156a10ffba310a544f9a6158e839" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d1507h2_8daaf6152771_9ec465a7d568", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1507h2", "b": "8daaf6152771", "c": "9ec465a7d568", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 7, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-10-65281-23-11-16-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789092648, "last_seen": 1789092648, "transport": "t", "ja3_hash": "349f80e7954d7ece430d272f66781bf6", "ja3_variant_count": 1, "ja3_variants": [ "349f80e7954d7ece430d272f66781bf6" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12d1507h2_8daaf6152771_a2681623a6b7", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1507h2", "b": "8daaf6152771", "c": "a2681623a6b7", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 7, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-16-0-35-27-65281-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790368781, "last_seen": 1790368781, "transport": "t", "ja3_hash": "7b5b10cd4a3eeaf9b57c44a522a23361", "ja3_variant_count": 1, "ja3_variants": [ "7b5b10cd4a3eeaf9b57c44a522a23361" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 9 }, "ua_disagreement": false } }, { "hash": "t12d1507h2_8daaf6152771_bb09cd15c32f", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1507h2", "b": "8daaf6152771", "c": "bb09cd15c32f", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 7, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-16-10-17613-27-0-23,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791029369, "last_seen": 1791029369, "transport": "t", "ja3_hash": "c6eeaffcb556e64d2f06630d70dd22e0", "ja3_variant_count": 1, "ja3_variants": [ "c6eeaffcb556e64d2f06630d70dd22e0" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36 Edg/153.0.0.0": 56 }, "ua_disagreement": false } }, { "hash": "t12d1507h2_8daaf6152771_be338bdd623b", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1507h2", "b": "8daaf6152771", "c": "be338bdd623b", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 7, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-13-0-5-35-16-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790241347, "last_seen": 1790241347, "transport": "t", "ja3_hash": "496b826b55bd5f5d731b1a7ea4cd07bf", "ja3_variant_count": 1, "ja3_variants": [ "496b826b55bd5f5d731b1a7ea4cd07bf" ], "user_agents": { "Mozilla/5.0 (iPhone; CPU iPhone OS 18_5 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/147.0.0.0 Mobile/15E148 Safari/604.1": 1 }, "ua_disagreement": false } }, { "hash": "t12d1507h2_8daaf6152771_e3c017f41192", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1507h2", "b": "8daaf6152771", "c": "e3c017f41192", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 7, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-23-16-0-17613-65281-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790258817, "last_seen": 1790258817, "transport": "t", "ja3_hash": "8a8bb52963791ff08f372ef673ef335e", "ja3_variant_count": 1, "ja3_variants": [ "8a8bb52963791ff08f372ef673ef335e" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d1507h2_8daaf6152771_e8afc78fbf38", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1507h2", "b": "8daaf6152771", "c": "e8afc78fbf38", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 7, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-17613-0-23-16-10-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789100221, "last_seen": 1789100221, "transport": "t", "ja3_hash": "1c5211b7119ff0b1aaf0603c41e7c30a", "ja3_variant_count": 1, "ja3_variants": [ "1c5211b7119ff0b1aaf0603c41e7c30a" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d1507h2_8daaf6152771_eb2f2971525c", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1507h2", "b": "8daaf6152771", "c": "eb2f2971525c", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 7, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-65281-11-16-23-0-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791164900, "last_seen": 1791164900, "transport": "t", "ja3_hash": "ecc901350f5a70029568a60b02cdf4e3", "ja3_variant_count": 1, "ja3_variants": [ "ecc901350f5a70029568a60b02cdf4e3" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d1507h2_8daaf6152771_f16344df59c9", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1507h2", "b": "8daaf6152771", "c": "f16344df59c9", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 7, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-16-65281-51-18-27-10,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 10, "name": "supported_groups", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791080381, "last_seen": 1791080381, "transport": "t", "ja3_hash": "91dc315001d96614f9e90c68ccc1e395", "ja3_variant_count": 1, "ja3_variants": [ "91dc315001d96614f9e90c68ccc1e395" ], "user_agents": { "Mozilla/5.0 (Linux; Android 15; Pixel 9) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Mobile Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d150800_8daaf6152771_00309e18d362", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150800", "b": "8daaf6152771", "c": "00309e18d362", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-0-27-17613-10-65281-51-16,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788724239, "last_seen": 1788724239, "transport": "t", "ja3_hash": "c790421a16bca5d34dc87285488d5dbf", "ja3_variant_count": 1, "ja3_variants": [ "c790421a16bca5d34dc87285488d5dbf" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d150800_8daaf6152771_00ab26af1d98", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150800", "b": "8daaf6152771", "c": "00ab26af1d98", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-45-23-35-65037-0-11-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790432553, "last_seen": 1790432553, "transport": "t", "ja3_hash": "00fe19aa465f6eb1f4a8b6cde3eb05a4", "ja3_variant_count": 1, "ja3_variants": [ "00fe19aa465f6eb1f4a8b6cde3eb05a4" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d150800_8daaf6152771_011a5f1af56b", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150800", "b": "8daaf6152771", "c": "011a5f1af56b", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-11-51-65281-35-10-0-13,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790996933, "last_seen": 1790996933, "transport": "t", "ja3_hash": "fdafceb7bc2a68373fe3ebfe72df359c", "ja3_variant_count": 1, "ja3_variants": [ "fdafceb7bc2a68373fe3ebfe72df359c" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d150800_8daaf6152771_07b25f7e5887", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150800", "b": "8daaf6152771", "c": "07b25f7e5887", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-65281-17613-0-23-11-45-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 2, "first_seen": 1790191583, "last_seen": 1791182852, "transport": "t", "ja3_hash": "fd25be2ec13b2c4df6e5c99da14419d3", "ja3_variant_count": 2, "ja3_variants": [ "fd25be2ec13b2c4df6e5c99da14419d3", "e01ca692f4f1676a6c6db330eb62db47" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 10 }, "ua_disagreement": false } }, { "hash": "t12d150800_8daaf6152771_0903fe4c75b9", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150800", "b": "8daaf6152771", "c": "0903fe4c75b9", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-27-65037-45-17613-0-5-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790035329, "last_seen": 1790035329, "transport": "t", "ja3_hash": "fbd3cd62e6a93bee528b597fc30ad159", "ja3_variant_count": 1, "ja3_variants": [ "fbd3cd62e6a93bee528b597fc30ad159" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36 Edg/135.0.0.0": 4 }, "ua_disagreement": false } }, { "hash": "t12d150800_8daaf6152771_09e44cf12005", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150800", "b": "8daaf6152771", "c": "09e44cf12005", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-45-17613-35-65281-23-51-43,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 43, "name": "supported_versions", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790736636, "last_seen": 1790736636, "transport": "t", "ja3_hash": "7fd4027906bb21ff9d2e4021965a8037", "ja3_variant_count": 1, "ja3_variants": [ "7fd4027906bb21ff9d2e4021965a8037" ], "user_agents": { "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36": 7 }, "ua_disagreement": false } }, { "hash": "t12d150800_8daaf6152771_0b21a40b059d", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150800", "b": "8daaf6152771", "c": "0b21a40b059d", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-5-11-35-65037-13-0-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789008556, "last_seen": 1789008556, "transport": "t", "ja3_hash": "31f658cfc2bf758d24e4c3cc774a2bb4", "ja3_variant_count": 1, "ja3_variants": [ "31f658cfc2bf758d24e4c3cc774a2bb4" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12d150800_8daaf6152771_0d080a75ee99", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150800", "b": "8daaf6152771", "c": "0d080a75ee99", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-65037-35-23-65281-10-0-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790792082, "last_seen": 1790792082, "transport": "t", "ja3_hash": "ee07b4126bdbdeb1d75f9dedc9991e16", "ja3_variant_count": 1, "ja3_variants": [ "ee07b4126bdbdeb1d75f9dedc9991e16" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 6 }, "ua_disagreement": false } }, { "hash": "t12d150800_8daaf6152771_19141369d0fe", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150800", "b": "8daaf6152771", "c": "19141369d0fe", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-45-0-18-11-27-35-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788812121, "last_seen": 1788812121, "transport": "t", "ja3_hash": "b09b05f07f584913c86c69cbac090c07", "ja3_variant_count": 1, "ja3_variants": [ "b09b05f07f584913c86c69cbac090c07" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36": 2 }, "ua_disagreement": false } }, { "hash": "t12d150800_8daaf6152771_214457f16040", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150800", "b": "8daaf6152771", "c": "214457f16040", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-17613-5-45-0-23-18-35,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 5, "name": "status_request", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 35, "name": "session_ticket", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789735704, "last_seen": 1789735704, "transport": "t", "ja3_hash": "e4d68ecec0c91a182d94c8ca7982feea", "ja3_variant_count": 1, "ja3_variants": [ "e4d68ecec0c91a182d94c8ca7982feea" ], "user_agents": { "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d150800_8daaf6152771_28bb07481da1", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150800", "b": "8daaf6152771", "c": "28bb07481da1", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-11-5-65281-65037-10-45-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790538830, "last_seen": 1790538830, "transport": "t", "ja3_hash": "fd012d46a4d30dfff470e1bafb4a56af", "ja3_variant_count": 1, "ja3_variants": [ "fd012d46a4d30dfff470e1bafb4a56af" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d150800_8daaf6152771_293bdad97863", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150800", "b": "8daaf6152771", "c": "293bdad97863", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-5-17613-0-65281-11-18-45,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 0, "name": "server_name", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788556596, "last_seen": 1788556596, "transport": "t", "ja3_hash": "1a7163a380619e4952d510003bfd8ac6", "ja3_variant_count": 1, "ja3_variants": [ "1a7163a380619e4952d510003bfd8ac6" ], "user_agents": { "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36": 4 }, "ua_disagreement": false } }, { "hash": "t12d150800_8daaf6152771_2991832e5d52", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150800", "b": "8daaf6152771", "c": "2991832e5d52", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-27-45-35-5-0-10-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790542210, "last_seen": 1790542210, "transport": "t", "ja3_hash": "9444a20053660f99bcc2231198e64746", "ja3_variant_count": 1, "ja3_variants": [ "9444a20053660f99bcc2231198e64746" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d150800_8daaf6152771_376ec5471d2e", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150800", "b": "8daaf6152771", "c": "376ec5471d2e", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-11-65281-10-5-51764-0-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790090771, "last_seen": 1790090771, "transport": "t", "ja3_hash": "a3152a0e51e284a7007ce66e1c0f20d3", "ja3_variant_count": 1, "ja3_variants": [ "a3152a0e51e284a7007ce66e1c0f20d3" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 13 }, "ua_disagreement": false } }, { "hash": "t12d150800_8daaf6152771_3bd478d9f4be", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150800", "b": "8daaf6152771", "c": "3bd478d9f4be", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-5-51764-0-11-23-10-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790083862, "last_seen": 1790083862, "transport": "t", "ja3_hash": "4fec6fea2c76ce15666e7d0604aaa4f8", "ja3_variant_count": 1, "ja3_variants": [ "4fec6fea2c76ce15666e7d0604aaa4f8" ], "user_agents": { "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 4 }, "ua_disagreement": false } }, { "hash": "t12d150800_8daaf6152771_3efa16f017e1", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150800", "b": "8daaf6152771", "c": "3efa16f017e1", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-65037-13-10-5-27-17513-51,29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 17513, "name": "application_settings", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791106734, "last_seen": 1791106734, "transport": "t", "ja3_hash": "3fcff77028a9365deaa8f03a04715f2b", "ja3_variant_count": 1, "ja3_variants": [ "3fcff77028a9365deaa8f03a04715f2b" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d150800_8daaf6152771_40c420be7914", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150800", "b": "8daaf6152771", "c": "40c420be7914", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-11-0-65281-45-23-10-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790569099, "last_seen": 1790569099, "transport": "t", "ja3_hash": "802954276cc98dbb13e01b26a0ec4e62", "ja3_variant_count": 1, "ja3_variants": [ "802954276cc98dbb13e01b26a0ec4e62" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d150800_8daaf6152771_4b8f4a2f1bf6", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150800", "b": "8daaf6152771", "c": "4b8f4a2f1bf6", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-23-65037-13-11-0-27-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788845610, "last_seen": 1788845610, "transport": "t", "ja3_hash": "48b140c3afd9a9c0f51c55a113f9ce52", "ja3_variant_count": 1, "ja3_variants": [ "48b140c3afd9a9c0f51c55a113f9ce52" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d150800_8daaf6152771_4d62064720ff", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150800", "b": "8daaf6152771", "c": "4d62064720ff", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-65281-5-65037-0-11-10-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788851062, "last_seen": 1788851062, "transport": "t", "ja3_hash": "3f0fb1268a21e2ce36aa3ee36debb7a1", "ja3_variant_count": 1, "ja3_variants": [ "3f0fb1268a21e2ce36aa3ee36debb7a1" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 YaBrowser/26.6.0.0 Safari/537.36": 10 }, "ua_disagreement": false } }, { "hash": "t12d150800_8daaf6152771_54b56c58a487", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150800", "b": "8daaf6152771", "c": "54b56c58a487", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-65281-27-0-18-45-13-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788781890, "last_seen": 1788781890, "transport": "t", "ja3_hash": "c9732ee0b3e5f456d304d228e975541a", "ja3_variant_count": 1, "ja3_variants": [ "c9732ee0b3e5f456d304d228e975541a" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12d150800_8daaf6152771_56693c728c0d", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150800", "b": "8daaf6152771", "c": "56693c728c0d", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-17613-10-13-0-5-65281-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791304069, "last_seen": 1791304069, "transport": "t", "ja3_hash": "8fac1dc1e3533cc2801b7a29ad84564a", "ja3_variant_count": 1, "ja3_variants": [ "8fac1dc1e3533cc2801b7a29ad84564a" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 10 }, "ua_disagreement": false } }, { "hash": "t12d150800_8daaf6152771_5ad293fdd18d", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150800", "b": "8daaf6152771", "c": "5ad293fdd18d", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-27-0-65037-13-35-18-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789576907, "last_seen": 1789576907, "transport": "t", "ja3_hash": "502a32a5c4a65cecf7aa0fa1205a1dce", "ja3_variant_count": 1, "ja3_variants": [ "502a32a5c4a65cecf7aa0fa1205a1dce" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36": 6 }, "ua_disagreement": false } }, { "hash": "t12d150800_8daaf6152771_5c9f8830e355", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150800", "b": "8daaf6152771", "c": "5c9f8830e355", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-65281-23-0-27-18-5-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788801878, "last_seen": 1788801878, "transport": "t", "ja3_hash": "61d8f171b0cc84b153de24b6b66fbd5f", "ja3_variant_count": 1, "ja3_variants": [ "61d8f171b0cc84b153de24b6b66fbd5f" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12d150800_8daaf6152771_6028de011c80", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150800", "b": "8daaf6152771", "c": "6028de011c80", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-0-65037-65281-35-18-10-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790226370, "last_seen": 1790226370, "transport": "t", "ja3_hash": "046f198f2696782b29a0988909da30b0", "ja3_variant_count": 1, "ja3_variants": [ "046f198f2696782b29a0988909da30b0" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d150800_8daaf6152771_621e4f03c30a", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150800", "b": "8daaf6152771", "c": "621e4f03c30a", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-0-65037-5-17613-45-13-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791001753, "last_seen": 1791001753, "transport": "t", "ja3_hash": "3dab0a58d7751db47f19354b5e63a6fb", "ja3_variant_count": 1, "ja3_variants": [ "3dab0a58d7751db47f19354b5e63a6fb" ], "user_agents": { "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Mobile Safari/537.36": 14 }, "ua_disagreement": false } }, { "hash": "t12d150800_8daaf6152771_66c8785d58ab", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150800", "b": "8daaf6152771", "c": "66c8785d58ab", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-65037-23-65281-13-0-27-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790727983, "last_seen": 1790727983, "transport": "t", "ja3_hash": "0995ab4f529909953f46a1627e720984", "ja3_variant_count": 1, "ja3_variants": [ "0995ab4f529909953f46a1627e720984" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 10 }, "ua_disagreement": false } }, { "hash": "t12d150800_8daaf6152771_6a463749cdd4", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150800", "b": "8daaf6152771", "c": "6a463749cdd4", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-27-18-10-0-35-65037-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790644951, "last_seen": 1790644951, "transport": "t", "ja3_hash": "53eb5b8aefcdf3422168eac9b4394af9", "ja3_variant_count": 1, "ja3_variants": [ "53eb5b8aefcdf3422168eac9b4394af9" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d150800_8daaf6152771_6d87a7ad7849", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150800", "b": "8daaf6152771", "c": "6d87a7ad7849", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-65037-35-13-27-0-10-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790242042, "last_seen": 1790242042, "transport": "t", "ja3_hash": "a6df11f299397e6c6cadca80285a9481", "ja3_variant_count": 1, "ja3_variants": [ "a6df11f299397e6c6cadca80285a9481" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d150800_8daaf6152771_722e10d9e6a7", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150800", "b": "8daaf6152771", "c": "722e10d9e6a7", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-45-11-13-0-51-17613-35,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 35, "name": "session_ticket", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790229178, "last_seen": 1790229178, "transport": "t", "ja3_hash": "ad7e082f0dacd6b40d2d4e60efedd826", "ja3_variant_count": 1, "ja3_variants": [ "ad7e082f0dacd6b40d2d4e60efedd826" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d150800_8daaf6152771_7d6466bb9a86", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150800", "b": "8daaf6152771", "c": "7d6466bb9a86", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-0-17613-65281-11-27-23-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789798019, "last_seen": 1789798019, "transport": "t", "ja3_hash": "65d722b1290f5b454544b65957ed024f", "ja3_variant_count": 1, "ja3_variants": [ "65d722b1290f5b454544b65957ed024f" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d150800_8daaf6152771_80505650bd57", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150800", "b": "8daaf6152771", "c": "80505650bd57", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-18-65281-27-5-13-0-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791225849, "last_seen": 1791225849, "transport": "t", "ja3_hash": "2171fa44560d4c37fc576bd1ffdc7b93", "ja3_variant_count": 1, "ja3_variants": [ "2171fa44560d4c37fc576bd1ffdc7b93" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 16 }, "ua_disagreement": false } }, { "hash": "t12d150800_8daaf6152771_8107f0247460", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150800", "b": "8daaf6152771", "c": "8107f0247460", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-0-10-17613-5-18-45-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 5, "name": "status_request", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791007894, "last_seen": 1791007894, "transport": "t", "ja3_hash": "dff9ba42623e2b04b3f30d7244a356df", "ja3_variant_count": 1, "ja3_variants": [ "dff9ba42623e2b04b3f30d7244a356df" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.1.0 Safari/537.36 Edg/131.1.0": 2 }, "ua_disagreement": false } }, { "hash": "t12d150800_8daaf6152771_851c60ffc66d", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150800", "b": "8daaf6152771", "c": "851c60ffc66d", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-65281-0-17613-65037-13-10-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788764746, "last_seen": 1788764746, "transport": "t", "ja3_hash": "5bcb1670fdbb8dbe4f950b90889486e5", "ja3_variant_count": 1, "ja3_variants": [ "5bcb1670fdbb8dbe4f950b90889486e5" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12d150800_8daaf6152771_8851bd83a0d2", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150800", "b": "8daaf6152771", "c": "8851bd83a0d2", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-10-5-45-65281-35-0-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790643200, "last_seen": 1790643200, "transport": "t", "ja3_hash": "639278a9855340fb4697a91f31280760", "ja3_variant_count": 1, "ja3_variants": [ "639278a9855340fb4697a91f31280760" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d150800_8daaf6152771_960c71b01bcd", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150800", "b": "8daaf6152771", "c": "960c71b01bcd", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-45-65037-5-13-10-0-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790718707, "last_seen": 1790718707, "transport": "t", "ja3_hash": "9a54de9a3b05cbbf4711ab18c00baadd", "ja3_variant_count": 1, "ja3_variants": [ "9a54de9a3b05cbbf4711ab18c00baadd" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d150800_8daaf6152771_9fd9771d76b7", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150800", "b": "8daaf6152771", "c": "9fd9771d76b7", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-35-11-0-65037-23-65281-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790236731, "last_seen": 1790236731, "transport": "t", "ja3_hash": "bf5844e8f9be8ad1bc67e9019f50608b", "ja3_variant_count": 1, "ja3_variants": [ "bf5844e8f9be8ad1bc67e9019f50608b" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d150800_8daaf6152771_a505fe1c753d", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150800", "b": "8daaf6152771", "c": "a505fe1c753d", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-5-0-51-27-10-35-45,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788959685, "last_seen": 1788959685, "transport": "t", "ja3_hash": "9e636039482269c983cba5b1300b9cd0", "ja3_variant_count": 1, "ja3_variants": [ "9e636039482269c983cba5b1300b9cd0" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d150800_8daaf6152771_a58a1a2ca2f5", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150800", "b": "8daaf6152771", "c": "a58a1a2ca2f5", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-35-65281-27-65037-23-5-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790642883, "last_seen": 1790642883, "transport": "t", "ja3_hash": "d2e9e7cd2750c7454993f36b9a618ead", "ja3_variant_count": 1, "ja3_variants": [ "d2e9e7cd2750c7454993f36b9a618ead" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d150800_8daaf6152771_a639675138d0", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150800", "b": "8daaf6152771", "c": "a639675138d0", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-27-5-23-11-65037-0-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 2, "first_seen": 1789889709, "last_seen": 1790534961, "transport": "t", "ja3_hash": "41b5426e9d6fa354e354fa4b06d1f721", "ja3_variant_count": 2, "ja3_variants": [ "41b5426e9d6fa354e354fa4b06d1f721", "b29f25c1b122d20a66a1e46794061178" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 13_0_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.1.0 Safari/537.36 Edg/131.1.0": 1 }, "ua_disagreement": false } }, { "hash": "t12d150800_8daaf6152771_a859c0f58553", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150800", "b": "8daaf6152771", "c": "a859c0f58553", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-17613-23-45-65281-0-10-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789576532, "last_seen": 1789576532, "transport": "t", "ja3_hash": "a4ea0c8d8b350d5b780c0d7c22d31668", "ja3_variant_count": 1, "ja3_variants": [ "a4ea0c8d8b350d5b780c0d7c22d31668" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36": 3 }, "ua_disagreement": false } }, { "hash": "t12d150800_8daaf6152771_a9f1645d3720", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150800", "b": "8daaf6152771", "c": "a9f1645d3720", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-65281-10-23-65037-18-0-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791226578, "last_seen": 1791226578, "transport": "t", "ja3_hash": "8960e8276c75a0ef70be16c8ae4ae119", "ja3_variant_count": 1, "ja3_variants": [ "8960e8276c75a0ef70be16c8ae4ae119" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36": 88 }, "ua_disagreement": false } }, { "hash": "t12d150800_8daaf6152771_abc7c8c14f19", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150800", "b": "8daaf6152771", "c": "abc7c8c14f19", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-11-45-65281-27-13-17613-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790229705, "last_seen": 1790229705, "transport": "t", "ja3_hash": "6d47a184b5a58bcce5a803f598970fa1", "ja3_variant_count": 1, "ja3_variants": [ "6d47a184b5a58bcce5a803f598970fa1" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36": 3 }, "ua_disagreement": false } }, { "hash": "t12d150800_8daaf6152771_bae352daf290", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150800", "b": "8daaf6152771", "c": "bae352daf290", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-0-10-11-51764-45-27-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790454163, "last_seen": 1790454163, "transport": "t", "ja3_hash": "6b35dc31464441df16479c3f3e8734b4", "ja3_variant_count": 1, "ja3_variants": [ "6b35dc31464441df16479c3f3e8734b4" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 5 }, "ua_disagreement": false } }, { "hash": "t12d150800_8daaf6152771_ce0d27a7be42", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150800", "b": "8daaf6152771", "c": "ce0d27a7be42", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-35-11-23-51-5-18-65037,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790876457, "last_seen": 1790876457, "transport": "t", "ja3_hash": "e0868c47f8368a86fa424fccbd2cc68d", "ja3_variant_count": 1, "ja3_variants": [ "e0868c47f8368a86fa424fccbd2cc68d" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 10 }, "ua_disagreement": false } }, { "hash": "t12d150800_8daaf6152771_d58cb5d1b22c", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150800", "b": "8daaf6152771", "c": "d58cb5d1b22c", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-23-17613-11-0-5-51764-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791229709, "last_seen": 1791229709, "transport": "t", "ja3_hash": "2eb2d3fdebc21acd792c39c250578c77", "ja3_variant_count": 1, "ja3_variants": [ "2eb2d3fdebc21acd792c39c250578c77" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36": 4 }, "ua_disagreement": false } }, { "hash": "t12d150800_8daaf6152771_d81fe1a9ef8c", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150800", "b": "8daaf6152771", "c": "d81fe1a9ef8c", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-51-27-18-5-45-17613-10,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 10, "name": "supported_groups", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791110301, "last_seen": 1791110301, "transport": "t", "ja3_hash": "8a9adc6259f69f21615c6390c3fbb267", "ja3_variant_count": 1, "ja3_variants": [ "8a9adc6259f69f21615c6390c3fbb267" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 10 }, "ua_disagreement": false } }, { "hash": "t12d150800_8daaf6152771_ebc3bacebd94", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150800", "b": "8daaf6152771", "c": "ebc3bacebd94", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-45-0-27-17613-18-13-23,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790238517, "last_seen": 1790238517, "transport": "t", "ja3_hash": "a18ab0c8999d8b9c05e53b316a00e958", "ja3_variant_count": 1, "ja3_variants": [ "a18ab0c8999d8b9c05e53b316a00e958" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d150800_8daaf6152771_f2855c265717", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150800", "b": "8daaf6152771", "c": "f2855c265717", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-17613-0-51-13-65281-18-45,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790258798, "last_seen": 1790258798, "transport": "t", "ja3_hash": "4b4d184988baff95c815da2e5fb15f21", "ja3_variant_count": 1, "ja3_variants": [ "4b4d184988baff95c815da2e5fb15f21" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d150800_8daaf6152771_f6d88400e4eb", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150800", "b": "8daaf6152771", "c": "f6d88400e4eb", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-45-27-11-13-65037-65281-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789348865, "last_seen": 1789348865, "transport": "t", "ja3_hash": "9d4288f536f814c03b34b0546f167686", "ja3_variant_count": 1, "ja3_variants": [ "9d4288f536f814c03b34b0546f167686" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 Edg/152.0.0.0": 1 }, "ua_disagreement": false } }, { "hash": "t12d1508h1_8daaf6152771_34253acf4c55", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1508h1", "b": "8daaf6152771", "c": "34253acf4c55", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": "h1" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-65281-11-45-0-16-27-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791131944, "last_seen": 1791131944, "transport": "t", "ja3_hash": "013368012e220b8d3ed79fc4db6483c8", "ja3_variant_count": 1, "ja3_variants": [ "013368012e220b8d3ed79fc4db6483c8" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d1508h1_8daaf6152771_440d82757558", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1508h1", "b": "8daaf6152771", "c": "440d82757558", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": "h1" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-18-5-10-65281-45-16-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790656461, "last_seen": 1790656461, "transport": "t", "ja3_hash": "513095bc4c94e0c37c1807315fc9fe3c", "ja3_variant_count": 1, "ja3_variants": [ "513095bc4c94e0c37c1807315fc9fe3c" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d1508h1_8daaf6152771_53821df629ce", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1508h1", "b": "8daaf6152771", "c": "53821df629ce", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": "h1" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-0-27-16-45-35-13-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790547234, "last_seen": 1790547234, "transport": "t", "ja3_hash": "72abc53c322a307a8855939bbffbab1a", "ja3_variant_count": 1, "ja3_variants": [ "72abc53c322a307a8855939bbffbab1a" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d1508h1_8daaf6152771_aa71e07b4d87", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1508h1", "b": "8daaf6152771", "c": "aa71e07b4d87", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": "h1" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-13-0-16-65281-35-11-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790538645, "last_seen": 1790538645, "transport": "t", "ja3_hash": "ec1366223dfb6c24331d300f5a3dd95a", "ja3_variant_count": 1, "ja3_variants": [ "ec1366223dfb6c24331d300f5a3dd95a" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d1508h2_8daaf6152771_006e83cc336b", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1508h2", "b": "8daaf6152771", "c": "006e83cc336b", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-10-16-0-27-18-17613-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791186120, "last_seen": 1791186120, "transport": "t", "ja3_hash": "fce675a34c7e52934a837c0f17c16abb", "ja3_variant_count": 1, "ja3_variants": [ "fce675a34c7e52934a837c0f17c16abb" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 10 }, "ua_disagreement": false } }, { "hash": "t12d1508h2_8daaf6152771_0d7c372af65b", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1508h2", "b": "8daaf6152771", "c": "0d7c372af65b", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-17613-51-11-0-35-16-5,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790911143, "last_seen": 1790911143, "transport": "t", "ja3_hash": "e42dd2f670fd9dfc42fdb4767259cc04", "ja3_variant_count": 1, "ja3_variants": [ "e42dd2f670fd9dfc42fdb4767259cc04" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d1508h2_8daaf6152771_139ce090b990", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1508h2", "b": "8daaf6152771", "c": "139ce090b990", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-27-18-11-35-51-0-16,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790304677, "last_seen": 1790304677, "transport": "t", "ja3_hash": "8267a9e3c61046b3a90f1adfa498dc4c", "ja3_variant_count": 1, "ja3_variants": [ "8267a9e3c61046b3a90f1adfa498dc4c" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36 Edg/153.0.0.0": 4 }, "ua_disagreement": false } }, { "hash": "t12d1508h2_8daaf6152771_163738e34f75", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1508h2", "b": "8daaf6152771", "c": "163738e34f75", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-17513-65037-16-65281-35-10-51,29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 17513, "name": "application_settings", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791151484, "last_seen": 1791151484, "transport": "t", "ja3_hash": "e48c16d146d1a351b187008283900d20", "ja3_variant_count": 1, "ja3_variants": [ "e48c16d146d1a351b187008283900d20" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d1508h2_8daaf6152771_1bb06c0688f6", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1508h2", "b": "8daaf6152771", "c": "1bb06c0688f6", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-5-23-16-51-0-17613-45,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 45, "name": "psk_key_exchange_modes", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790423544, "last_seen": 1790423544, "transport": "t", "ja3_hash": "d07082a6eb42ad9d6915ed8b196a3f27", "ja3_variant_count": 1, "ja3_variants": [ "d07082a6eb42ad9d6915ed8b196a3f27" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d1508h2_8daaf6152771_62ed8481507b", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1508h2", "b": "8daaf6152771", "c": "62ed8481507b", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-13-16-0-23-45-10-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789751362, "last_seen": 1789751362, "transport": "t", "ja3_hash": "4a46d00015a27707f2863a4ffbe931ba", "ja3_variant_count": 1, "ja3_variants": [ "4a46d00015a27707f2863a4ffbe931ba" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36": 6 }, "ua_disagreement": false } }, { "hash": "t12d1508h2_8daaf6152771_77a600148ece", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1508h2", "b": "8daaf6152771", "c": "77a600148ece", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-35-16-27-0-45-17613-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789666814, "last_seen": 1789666814, "transport": "t", "ja3_hash": "47663536ae4cf775d38c96f3be888ca1", "ja3_variant_count": 1, "ja3_variants": [ "47663536ae4cf775d38c96f3be888ca1" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 11 }, "ua_disagreement": false } }, { "hash": "t12d1508h2_8daaf6152771_8fdc367e25c9", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1508h2", "b": "8daaf6152771", "c": "8fdc367e25c9", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-65281-18-35-10-45-0-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788590364, "last_seen": 1788590364, "transport": "t", "ja3_hash": "2ccbbd4c97046baa968a6b58a52faf1b", "ja3_variant_count": 1, "ja3_variants": [ "2ccbbd4c97046baa968a6b58a52faf1b" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d1508h2_8daaf6152771_945668e0c70e", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1508h2", "b": "8daaf6152771", "c": "945668e0c70e", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-16-11-0-17613-51-5-35,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 35, "name": "session_ticket", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789269656, "last_seen": 1789269656, "transport": "t", "ja3_hash": "488451d90f0bb8dba09699906a22fb2f", "ja3_variant_count": 1, "ja3_variants": [ "488451d90f0bb8dba09699906a22fb2f" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 Edg/152.0.0.0": 5 }, "ua_disagreement": false } }, { "hash": "t12d1508h2_8daaf6152771_a3ad0ff574ca", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1508h2", "b": "8daaf6152771", "c": "a3ad0ff574ca", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-16-11-27-0-51-65281-5,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 5, "name": "status_request", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789686180, "last_seen": 1789686180, "transport": "t", "ja3_hash": "0cd2c307ca967f3e26cfeb99d302e70b", "ja3_variant_count": 1, "ja3_variants": [ "0cd2c307ca967f3e26cfeb99d302e70b" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36 Edg/153.0.0.0": 2 }, "ua_disagreement": false } }, { "hash": "t12d1508h2_8daaf6152771_a77bd6e9a962", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1508h2", "b": "8daaf6152771", "c": "a77bd6e9a962", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51764-0-23-18-10-45-16-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788723973, "last_seen": 1788723973, "transport": "t", "ja3_hash": "fc7cc7a836924338d6040c66d19ba75d", "ja3_variant_count": 1, "ja3_variants": [ "fc7cc7a836924338d6040c66d19ba75d" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d1508h2_8daaf6152771_aaa7a8cca642", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1508h2", "b": "8daaf6152771", "c": "aaa7a8cca642", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-13-65037-0-16-18-23-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790053082, "last_seen": 1790053082, "transport": "t", "ja3_hash": "e1855a7102528a9fe12303693deb6f80", "ja3_variant_count": 1, "ja3_variants": [ "e1855a7102528a9fe12303693deb6f80" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36": 4 }, "ua_disagreement": false } }, { "hash": "t12d1508h2_8daaf6152771_b6fb66a9c40d", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1508h2", "b": "8daaf6152771", "c": "b6fb66a9c40d", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-10-0-16-18-35-45-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790201518, "last_seen": 1790201518, "transport": "t", "ja3_hash": "374bdb761a892e83b5ccb7eec9ea85f9", "ja3_variant_count": 1, "ja3_variants": [ "374bdb761a892e83b5ccb7eec9ea85f9" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d1508h2_8daaf6152771_bb28d51f298a", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1508h2", "b": "8daaf6152771", "c": "bb28d51f298a", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-65281-23-10-0-35-65037-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788798357, "last_seen": 1788798357, "transport": "t", "ja3_hash": "835a36bf7d600792ce1c75cfe3bbb879", "ja3_variant_count": 1, "ja3_variants": [ "835a36bf7d600792ce1c75cfe3bbb879" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12d1508h2_8daaf6152771_bebc93064de2", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1508h2", "b": "8daaf6152771", "c": "bebc93064de2", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-10-0-16-5-23-65281-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789066173, "last_seen": 1789066173, "transport": "t", "ja3_hash": "c9aa4a8ed0d71a0b2030311dedef909b", "ja3_variant_count": 1, "ja3_variants": [ "c9aa4a8ed0d71a0b2030311dedef909b" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36 Edg/148.0.0.0": 1 }, "ua_disagreement": false } }, { "hash": "t12d1508h2_8daaf6152771_dca1c142f781", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1508h2", "b": "8daaf6152771", "c": "dca1c142f781", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-27-65281-18-16-45-35-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790876478, "last_seen": 1790876478, "transport": "t", "ja3_hash": "d50e4c2974a7be2969558e86ad46fc20", "ja3_variant_count": 1, "ja3_variants": [ "d50e4c2974a7be2969558e86ad46fc20" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 10 }, "ua_disagreement": false } }, { "hash": "t12d1508h2_8daaf6152771_f07f746e3284", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1508h2", "b": "8daaf6152771", "c": "f07f746e3284", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-0-18-65037-23-11-16-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790948892, "last_seen": 1790948892, "transport": "t", "ja3_hash": "0e2dc57568d0237041c7905cf2e96aa7", "ja3_variant_count": 1, "ja3_variants": [ "0e2dc57568d0237041c7905cf2e96aa7" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d1508h2_8daaf6152771_f71fcdef798d", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1508h2", "b": "8daaf6152771", "c": "f71fcdef798d", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 8, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-18-0-65037-35-27-16-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 2, "first_seen": 1788899636, "last_seen": 1789006086, "transport": "t", "ja3_hash": "0e9d9a708e2f904b7d289a310411c919", "ja3_variant_count": 2, "ja3_variants": [ "0e9d9a708e2f904b7d289a310411c919", "e54c488c45ee321e91f274049e02d4d8" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 Edg/152.0.0.0": 7 }, "ua_disagreement": false } }, { "hash": "t12d150900_8daaf6152771_012cb0b73229", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150900", "b": "8daaf6152771", "c": "012cb0b73229", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-65281-65037-18-17613-0-35-5-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791157110, "last_seen": 1791157110, "transport": "t", "ja3_hash": "94a7c13c1b22a4c32c457edb11a1dade", "ja3_variant_count": 1, "ja3_variants": [ "94a7c13c1b22a4c32c457edb11a1dade" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d150900_8daaf6152771_076c4c995ec5", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150900", "b": "8daaf6152771", "c": "076c4c995ec5", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-45-17613-0-65037-27-23-35-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 0, "name": "server_name", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790433487, "last_seen": 1790433487, "transport": "t", "ja3_hash": "e02059f8a4960f89d0f6f75a8db5ce32", "ja3_variant_count": 1, "ja3_variants": [ "e02059f8a4960f89d0f6f75a8db5ce32" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d150900_8daaf6152771_0fd65098570f", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150900", "b": "8daaf6152771", "c": "0fd65098570f", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-17613-11-65281-65037-5-0-13-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789009456, "last_seen": 1789009456, "transport": "t", "ja3_hash": "781302c621023bc4a0309b7f1059e8a0", "ja3_variant_count": 1, "ja3_variants": [ "781302c621023bc4a0309b7f1059e8a0" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12d150900_8daaf6152771_17adb3e7b930", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150900", "b": "8daaf6152771", "c": "17adb3e7b930", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-0-17613-10-5-18-65037-35-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790823276, "last_seen": 1790823276, "transport": "t", "ja3_hash": "ac683da8badb9f36a3574f2364e015cd", "ja3_variant_count": 1, "ja3_variants": [ "ac683da8badb9f36a3574f2364e015cd" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 10 }, "ua_disagreement": false } }, { "hash": "t12d150900_8daaf6152771_2ccf1c72ae65", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150900", "b": "8daaf6152771", "c": "2ccf1c72ae65", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-5-51-18-0-65281-10-65037-13,29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791102866, "last_seen": 1791102866, "transport": "t", "ja3_hash": "8dbe9357c30604c28ac425d6a63e148b", "ja3_variant_count": 1, "ja3_variants": [ "8dbe9357c30604c28ac425d6a63e148b" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0": 1 }, "ua_disagreement": false } }, { "hash": "t12d150900_8daaf6152771_4c7e41770b67", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150900", "b": "8daaf6152771", "c": "4c7e41770b67", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-18-27-65037-0-17613-10-13-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790509011, "last_seen": 1790509011, "transport": "t", "ja3_hash": "64d6aa1b71c6806902d9557e662ba2b0", "ja3_variant_count": 1, "ja3_variants": [ "64d6aa1b71c6806902d9557e662ba2b0" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) WorkBuddy/5.6.2 Chrome/138.0.7204.251 Electron/37.10.3 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d150900_8daaf6152771_4e00e9624d0c", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150900", "b": "8daaf6152771", "c": "4e00e9624d0c", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-65281-23-13-35-0-5-18-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789033650, "last_seen": 1789033650, "transport": "t", "ja3_hash": "4d76d3631872c8a801002d3464f4820c", "ja3_variant_count": 1, "ja3_variants": [ "4d76d3631872c8a801002d3464f4820c" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12d150900_8daaf6152771_536c74859f3e", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150900", "b": "8daaf6152771", "c": "536c74859f3e", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-18-0-11-35-17613-65037-45-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790751825, "last_seen": 1790751825, "transport": "t", "ja3_hash": "7daba22d5dbd34867f269a4e21400acb", "ja3_variant_count": 1, "ja3_variants": [ "7daba22d5dbd34867f269a4e21400acb" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36 Edg/153.0.0.0": 4 }, "ua_disagreement": false } }, { "hash": "t12d150900_8daaf6152771_5cdf62706432", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150900", "b": "8daaf6152771", "c": "5cdf62706432", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-65281-27-5-13-0-11-10-51,25497-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 25497, "name": "X25519Kyber768Draft00", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790656246, "last_seen": 1790656246, "transport": "t", "ja3_hash": "b7181657720c15673300ac380bd9fa85", "ja3_variant_count": 1, "ja3_variants": [ "b7181657720c15673300ac380bd9fa85" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d150900_8daaf6152771_5f3ace801959", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150900", "b": "8daaf6152771", "c": "5f3ace801959", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-18-65037-65281-0-23-35-51-13,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791106734, "last_seen": 1791106734, "transport": "t", "ja3_hash": "36fb8e7a9cd76bcb01470b5b4f2c296c", "ja3_variant_count": 1, "ja3_variants": [ "36fb8e7a9cd76bcb01470b5b4f2c296c" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d150900_8daaf6152771_60a4a9d0011b", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150900", "b": "8daaf6152771", "c": "60a4a9d0011b", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-13-10-11-18-65037-35-0-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790228713, "last_seen": 1790228713, "transport": "t", "ja3_hash": "67fda05c56cbbf5df4f8284fae78c85e", "ja3_variant_count": 1, "ja3_variants": [ "67fda05c56cbbf5df4f8284fae78c85e" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d150900_8daaf6152771_64c05488f0c6", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150900", "b": "8daaf6152771", "c": "64c05488f0c6", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-45-5-0-27-23-65037-18-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789964824, "last_seen": 1789964824, "transport": "t", "ja3_hash": "6fb93722c0152573b436ff554aadb1fb", "ja3_variant_count": 1, "ja3_variants": [ "6fb93722c0152573b436ff554aadb1fb" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d150900_8daaf6152771_6a2156c240f5", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150900", "b": "8daaf6152771", "c": "6a2156c240f5", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-23-45-5-0-27-51-18-65037,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789628492, "last_seen": 1789628492, "transport": "t", "ja3_hash": "225e48441b43892d339df3a7c18107ad", "ja3_variant_count": 1, "ja3_variants": [ "225e48441b43892d339df3a7c18107ad" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d150900_8daaf6152771_6a4b43531bc2", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150900", "b": "8daaf6152771", "c": "6a4b43531bc2", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-23-0-27-51-10-5-65281-16,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790566124, "last_seen": 1790566124, "transport": "t", "ja3_hash": "634ef483ed284f61ca5a5c785b494267", "ja3_variant_count": 1, "ja3_variants": [ "634ef483ed284f61ca5a5c785b494267" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36": 2 }, "ua_disagreement": false } }, { "hash": "t12d150900_8daaf6152771_72eaf91850df", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150900", "b": "8daaf6152771", "c": "72eaf91850df", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-5-27-10-23-65281-35-17613-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790191104, "last_seen": 1790191104, "transport": "t", "ja3_hash": "6b8046113ade58eb802aa119b3c21a32", "ja3_variant_count": 1, "ja3_variants": [ "6b8046113ade58eb802aa119b3c21a32" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d150900_8daaf6152771_734db862881e", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150900", "b": "8daaf6152771", "c": "734db862881e", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-5-17613-65037-27-11-0-23-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790745588, "last_seen": 1790745588, "transport": "t", "ja3_hash": "94a033896e43926891436b7e957ed6cd", "ja3_variant_count": 1, "ja3_variants": [ "94a033896e43926891436b7e957ed6cd" ], "user_agents": { "Mozilla/5.0 (iPhone; CPU iPhone OS 18_3 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/148.0.0.0 Mobile/15E148 Safari/604.1": 1 }, "ua_disagreement": false } }, { "hash": "t12d150900_8daaf6152771_753545e98d49", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150900", "b": "8daaf6152771", "c": "753545e98d49", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-0-65281-18-23-27-11-35-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788998439, "last_seen": 1788998439, "transport": "t", "ja3_hash": "8c40dd38b97894a21fc835f5d33c4358", "ja3_variant_count": 1, "ja3_variants": [ "8c40dd38b97894a21fc835f5d33c4358" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d150900_8daaf6152771_7e7f4287d3b5", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150900", "b": "8daaf6152771", "c": "7e7f4287d3b5", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-65037-11-23-27-35-45-0-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790227486, "last_seen": 1790227486, "transport": "t", "ja3_hash": "7c420d39ff9187f724aec416637ec8b0", "ja3_variant_count": 1, "ja3_variants": [ "7c420d39ff9187f724aec416637ec8b0" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d150900_8daaf6152771_7f064daffae0", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150900", "b": "8daaf6152771", "c": "7f064daffae0", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-10-35-5-65037-0-17613-45-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790191988, "last_seen": 1790191988, "transport": "t", "ja3_hash": "5b36f213b0bf35159e45698154ea8490", "ja3_variant_count": 1, "ja3_variants": [ "5b36f213b0bf35159e45698154ea8490" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d150900_8daaf6152771_89f955ecc8ba", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150900", "b": "8daaf6152771", "c": "89f955ecc8ba", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-13-51764-18-17613-65281-65037-10-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789750046, "last_seen": 1789750046, "transport": "t", "ja3_hash": "ce104668376d56b6168a91527645993a", "ja3_variant_count": 1, "ja3_variants": [ "ce104668376d56b6168a91527645993a" ], "user_agents": { "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36": 2 }, "ua_disagreement": false } }, { "hash": "t12d150900_8daaf6152771_9a968430898c", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150900", "b": "8daaf6152771", "c": "9a968430898c", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-0-35-13-18-45-65281-10-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789283181, "last_seen": 1789283181, "transport": "t", "ja3_hash": "a13e2320624951bd8a218234600fba1f", "ja3_variant_count": 1, "ja3_variants": [ "a13e2320624951bd8a218234600fba1f" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36": 9 }, "ua_disagreement": false } }, { "hash": "t12d150900_8daaf6152771_9b220515a118", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150900", "b": "8daaf6152771", "c": "9b220515a118", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-35-5-11-10-0-45-23-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791125284, "last_seen": 1791125284, "transport": "t", "ja3_hash": "0ddf739f3d3bc31dc2b30f012d86231a", "ja3_variant_count": 1, "ja3_variants": [ "0ddf739f3d3bc31dc2b30f012d86231a" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d150900_8daaf6152771_9c056901e4ee", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150900", "b": "8daaf6152771", "c": "9c056901e4ee", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-65281-45-35-0-13-11-17613-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790243383, "last_seen": 1790243383, "transport": "t", "ja3_hash": "7e7ca46ddaeb895bce7ca972da896618", "ja3_variant_count": 1, "ja3_variants": [ "7e7ca46ddaeb895bce7ca972da896618" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d150900_8daaf6152771_a1cf161cf7f7", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150900", "b": "8daaf6152771", "c": "a1cf161cf7f7", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-5-45-51-27-10-23-11-17613,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790621414, "last_seen": 1790621414, "transport": "t", "ja3_hash": "cf59a3c892a21a60dc2fcc08a6501121", "ja3_variant_count": 1, "ja3_variants": [ "cf59a3c892a21a60dc2fcc08a6501121" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36 Edg/154.0.0.0": 18 }, "ua_disagreement": false } }, { "hash": "t12d150900_8daaf6152771_ae54783c8a84", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150900", "b": "8daaf6152771", "c": "ae54783c8a84", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-5-23-0-35-10-65281-11-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 5, "name": "status_request", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790031411, "last_seen": 1790031411, "transport": "t", "ja3_hash": "dc9abb0e588d07de32c2d81c16c37b5f", "ja3_variant_count": 1, "ja3_variants": [ "dc9abb0e588d07de32c2d81c16c37b5f" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 46 }, "ua_disagreement": false } }, { "hash": "t12d150900_8daaf6152771_b2bc4517cdc2", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150900", "b": "8daaf6152771", "c": "b2bc4517cdc2", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-0-18-10-35-65281-51764-11-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790188278, "last_seen": 1790188278, "transport": "t", "ja3_hash": "9eb40a1bbc6b62dabb72e92278fc07fd", "ja3_variant_count": 1, "ja3_variants": [ "9eb40a1bbc6b62dabb72e92278fc07fd" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36": 14 }, "ua_disagreement": false } }, { "hash": "t12d150900_8daaf6152771_b2d023f7765d", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150900", "b": "8daaf6152771", "c": "b2d023f7765d", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-13-65037-10-23-35-65281-17613-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789839790, "last_seen": 1789839790, "transport": "t", "ja3_hash": "9b84ff51dbc14d8be6a65d1bbca9f997", "ja3_variant_count": 1, "ja3_variants": [ "9b84ff51dbc14d8be6a65d1bbca9f997" ], "user_agents": { "Mozilla/5.0 (Linux; Android 14; Pixel 8 Pro) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36": 4 }, "ua_disagreement": false } }, { "hash": "t12d150900_8daaf6152771_bd302e63541f", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150900", "b": "8daaf6152771", "c": "bd302e63541f", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51764-35-5-27-45-17613-23-0-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789517320, "last_seen": 1789517320, "transport": "t", "ja3_hash": "90808fddc331b133750165b389ac03a0", "ja3_variant_count": 1, "ja3_variants": [ "90808fddc331b133750165b389ac03a0" ], "user_agents": { "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36": 5 }, "ua_disagreement": false } }, { "hash": "t12d150900_8daaf6152771_c06fde8eb55b", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150900", "b": "8daaf6152771", "c": "c06fde8eb55b", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-17613-11-5-51764-35-65281-0-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789063163, "last_seen": 1789063163, "transport": "t", "ja3_hash": "c35edce37db3303323651dc1e1b69c33", "ja3_variant_count": 1, "ja3_variants": [ "c35edce37db3303323651dc1e1b69c33" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 23 }, "ua_disagreement": false } }, { "hash": "t12d150900_8daaf6152771_c0f419eee790", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150900", "b": "8daaf6152771", "c": "c0f419eee790", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-11-65037-27-65281-10-0-45-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788798637, "last_seen": 1788798637, "transport": "t", "ja3_hash": "40da22d5e5262254acf08a44d7c4c5ba", "ja3_variant_count": 1, "ja3_variants": [ "40da22d5e5262254acf08a44d7c4c5ba" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d150900_8daaf6152771_c2e37bf9a8ad", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150900", "b": "8daaf6152771", "c": "c2e37bf9a8ad", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-35-27-13-0-5-23-10-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789682013, "last_seen": 1789682013, "transport": "t", "ja3_hash": "f91cefaea172c75697b87becfe6ad729", "ja3_variant_count": 1, "ja3_variants": [ "f91cefaea172c75697b87becfe6ad729" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12d150900_8daaf6152771_c38bff314e1c", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150900", "b": "8daaf6152771", "c": "c38bff314e1c", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-23-0-11-45-10-5-18-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790240108, "last_seen": 1790240108, "transport": "t", "ja3_hash": "0d8234a1c780032f813d18059e67ac3f", "ja3_variant_count": 1, "ja3_variants": [ "0d8234a1c780032f813d18059e67ac3f" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d150900_8daaf6152771_d9f0d4192f75", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150900", "b": "8daaf6152771", "c": "d9f0d4192f75", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-13-0-23-17613-5-65037-18-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 5, "name": "status_request", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790696174, "last_seen": 1790696174, "transport": "t", "ja3_hash": "b2a3c6e396a74e34badf1ff8ed19c55f", "ja3_variant_count": 1, "ja3_variants": [ "b2a3c6e396a74e34badf1ff8ed19c55f" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36 Edg/154.0.0.0": 16 }, "ua_disagreement": false } }, { "hash": "t12d150900_8daaf6152771_e4de5e82ef73", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150900", "b": "8daaf6152771", "c": "e4de5e82ef73", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-0-18-65281-5-51-17613-45-16,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789570701, "last_seen": 1789570701, "transport": "t", "ja3_hash": "ec3d3e385e901bacab8dfe3fa9d213f2", "ja3_variant_count": 1, "ja3_variants": [ "ec3d3e385e901bacab8dfe3fa9d213f2" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 15 }, "ua_disagreement": false } }, { "hash": "t12d150900_8daaf6152771_eb208de54404", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150900", "b": "8daaf6152771", "c": "eb208de54404", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-23-65037-5-11-45-27-65281-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788887862, "last_seen": 1788887862, "transport": "t", "ja3_hash": "b41cda1ff03854d07af1cb23f5ae75f6", "ja3_variant_count": 1, "ja3_variants": [ "b41cda1ff03854d07af1cb23f5ae75f6" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d150900_8daaf6152771_ed2a48320f1e", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150900", "b": "8daaf6152771", "c": "ed2a48320f1e", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-27-0-18-51-11-65281-23-16,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790829013, "last_seen": 1790829013, "transport": "t", "ja3_hash": "837c928e6e6c5bd06f1637d96688c3df", "ja3_variant_count": 1, "ja3_variants": [ "837c928e6e6c5bd06f1637d96688c3df" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 12_0_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.1.0 Safari/537.36 Edg/130.1.0": 1 }, "ua_disagreement": false } }, { "hash": "t12d150900_8daaf6152771_ef9280127124", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150900", "b": "8daaf6152771", "c": "ef9280127124", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-65281-45-17613-0-5-11-18-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789028517, "last_seen": 1789028517, "transport": "t", "ja3_hash": "c47d0afbf76f5bbab5db0842c08fdf18", "ja3_variant_count": 1, "ja3_variants": [ "c47d0afbf76f5bbab5db0842c08fdf18" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12d150900_8daaf6152771_f3b401cad7d8", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150900", "b": "8daaf6152771", "c": "f3b401cad7d8", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-35-65037-5-13-10-23-17613-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790080412, "last_seen": 1790080412, "transport": "t", "ja3_hash": "f7db7894fad32878c2a0d2739780268c", "ja3_variant_count": 1, "ja3_variants": [ "f7db7894fad32878c2a0d2739780268c" ], "user_agents": { "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Mobile Safari/537.36": 3 }, "ua_disagreement": false } }, { "hash": "t12d150900_8daaf6152771_f5faadd4032b", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150900", "b": "8daaf6152771", "c": "f5faadd4032b", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-65281-35-11-27-45-23-17613-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788739282, "last_seen": 1788739282, "transport": "t", "ja3_hash": "3f47eb1769ca2f4bc21c308d9f41414e", "ja3_variant_count": 1, "ja3_variants": [ "3f47eb1769ca2f4bc21c308d9f41414e" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12d150900_8daaf6152771_fcb98c4e0d03", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150900", "b": "8daaf6152771", "c": "fcb98c4e0d03", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-45-65281-0-23-35-17613-51-13,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790702996, "last_seen": 1790702996, "transport": "t", "ja3_hash": "13d54acc86baecac6702ae8bc17eeca8", "ja3_variant_count": 1, "ja3_variants": [ "13d54acc86baecac6702ae8bc17eeca8" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36": 3 }, "ua_disagreement": false } }, { "hash": "t12d150900_8daaf6152771_fe09333a7d32", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d150900", "b": "8daaf6152771", "c": "fe09333a7d32", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-11-18-65281-51-35-45-0-13,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789776178, "last_seen": 1789776178, "transport": "t", "ja3_hash": "e485549c4bce7ee2c338052753967c49", "ja3_variant_count": 1, "ja3_variants": [ "e485549c4bce7ee2c338052753967c49" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36 Edg/135.0.0.0": 4 }, "ua_disagreement": false } }, { "hash": "t12d1509h1_8daaf6152771_08c3c5238ca8", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1509h1", "b": "8daaf6152771", "c": "08c3c5238ca8", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": "h1" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-5-16-18-23-13-11-0-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790656384, "last_seen": 1790656384, "transport": "t", "ja3_hash": "2b0b16623cc1b2b6159a0469a00e94a6", "ja3_variant_count": 1, "ja3_variants": [ "2b0b16623cc1b2b6159a0469a00e94a6" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d1509h1_8daaf6152771_25dcf7ba72a4", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1509h1", "b": "8daaf6152771", "c": "25dcf7ba72a4", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": "h1" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-0-45-10-11-16-65037-23-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790674057, "last_seen": 1790674057, "transport": "t", "ja3_hash": "a8649b78d17f449db18398ad7f46172b", "ja3_variant_count": 1, "ja3_variants": [ "a8649b78d17f449db18398ad7f46172b" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d1509h1_8daaf6152771_b5c435c068e0", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Shares its JA4_c (b5c435c068e0) with 1 fingerprint classified as browser, and nothing else in that family disagrees \u2014 the same tool under different cipher options. Inferred from the family, not observed directly.", "ja4": { "a": "t12d1509h1", "b": "8daaf6152771", "c": "b5c435c068e0", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": "h1" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-45-5-13-0-65281-16-23-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790524700, "last_seen": 1790524700, "transport": "t", "ja3_hash": "06076b1c601aee365a7bdf0acd09af9d", "ja3_variant_count": 1, "ja3_variants": [ "06076b1c601aee365a7bdf0acd09af9d" ], "user_agents": [], "ua_disagreement": false }, "inferred_from_family": true }, { "hash": "t12d1509h2_073e58a039a6_7081e2cbd3c7", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Seen in live traffic; not in the curated database.", "ja4": { "a": "t12d1509h2", "b": "073e58a039a6", "c": "7081e2cbd3c7", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,49195-49199-52393-52392-49196-49200-49162-49161-49171-49172-51-57-47-53-10,0-23-65281-10-11-35-16-5-13,29-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49162, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 49161, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 51, "name": "TLS_DHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 57, "name": "TLS_DHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 10, "name": "TLS_RSA_WITH_3DES_EDE_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 2, "first_seen": 1789546274, "last_seen": 1790851498, "transport": "t", "ja3_hash": "0ffee3ba8e615ad22535e7f771690a28", "ja3_variant_count": 1, "ja3_variants": [ "0ffee3ba8e615ad22535e7f771690a28" ], "user_agents": [], "ua_disagreement": false } }, { "hash": "t12d1509h2_8daaf6152771_028b3ae9db7a", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1509h2", "b": "8daaf6152771", "c": "028b3ae9db7a", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-11-18-13-65281-45-0-23-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790232122, "last_seen": 1790232122, "transport": "t", "ja3_hash": "4d46363569c5a90aa94196b0053f30d9", "ja3_variant_count": 1, "ja3_variants": [ "4d46363569c5a90aa94196b0053f30d9" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d1509h2_8daaf6152771_06dbb2297f1f", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1509h2", "b": "8daaf6152771", "c": "06dbb2297f1f", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-45-65037-11-16-65281-0-10-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790216266, "last_seen": 1790216266, "transport": "t", "ja3_hash": "376acab6745f87aa9c75e59de465b18c", "ja3_variant_count": 1, "ja3_variants": [ "376acab6745f87aa9c75e59de465b18c" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d1509h2_8daaf6152771_0706ce7a8c05", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1509h2", "b": "8daaf6152771", "c": "0706ce7a8c05", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-11-5-0-45-65037-27-16-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790464285, "last_seen": 1790464285, "transport": "t", "ja3_hash": "271a22120e6fc1658e9d34e4380d351a", "ja3_variant_count": 1, "ja3_variants": [ "271a22120e6fc1658e9d34e4380d351a" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36 Edg/153.0.0.0": 229 }, "ua_disagreement": false } }, { "hash": "t12d1509h2_8daaf6152771_17d58b7b81b7", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1509h2", "b": "8daaf6152771", "c": "17d58b7b81b7", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-65281-0-5-10-13-18-51764-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789214256, "last_seen": 1789214256, "transport": "t", "ja3_hash": "b51c1ef2b9265c55a2402e30d38df08c", "ja3_variant_count": 1, "ja3_variants": [ "b51c1ef2b9265c55a2402e30d38df08c" ], "user_agents": { "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Mobile Safari/537.36": 13 }, "ua_disagreement": false } }, { "hash": "t12d1509h2_8daaf6152771_19c4b027752a", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Firefox \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1509h2", "b": "8daaf6152771", "c": "19c4b027752a", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,4865-4867-4866-49195-49199-52393-52392-49196-49200-49171-49172-156-157-47-53,0-23-65281-10-11-16-5-34-51,4588-29-23-24-25-256-257,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 34, "name": "34 (0x0022)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 95, "first_seen": 1787540622, "last_seen": 1788768237, "transport": "t", "ja3_hash": "6d7fcd8d30bce4bae53bdcf30033f901", "ja3_variant_count": 1, "ja3_variants": [ "6d7fcd8d30bce4bae53bdcf30033f901" ], "user_agents": { "Mozilla/5.0 (Android 17; Mobile; rv:154.0) Gecko/154.0 Firefox/154.0": 37, "Mozilla/5.0 (Android 16; Mobile; rv:154.0) Gecko/154.0 Firefox/154.0": 12, "Mozilla/5.0 (Android 13; Mobile; rv:154.0) Gecko/154.0 Firefox/154.0": 874 }, "ua_disagreement": false } }, { "hash": "t12d1509h2_8daaf6152771_267e13b70f90", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1509h2", "b": "8daaf6152771", "c": "267e13b70f90", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-16-45-35-0-10-13-11-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788759944, "last_seen": 1788759944, "transport": "t", "ja3_hash": "9e6e0583a304812dc7ec8c60a74af537", "ja3_variant_count": 1, "ja3_variants": [ "9e6e0583a304812dc7ec8c60a74af537" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12d1509h2_8daaf6152771_2aae971cb6f6", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1509h2", "b": "8daaf6152771", "c": "2aae971cb6f6", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-16-18-27-35-5-45-0-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790177557, "last_seen": 1790177557, "transport": "t", "ja3_hash": "58d138b6595477fdfb022c0965e5b2a1", "ja3_variant_count": 1, "ja3_variants": [ "58d138b6595477fdfb022c0965e5b2a1" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d1509h2_8daaf6152771_2ba35cf65288", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1509h2", "b": "8daaf6152771", "c": "2ba35cf65288", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-65281-0-45-23-16-18-35-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790263774, "last_seen": 1790263774, "transport": "t", "ja3_hash": "6158a8e64cb6a28c3f613cf6dafa8b5f", "ja3_variant_count": 1, "ja3_variants": [ "6158a8e64cb6a28c3f613cf6dafa8b5f" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d1509h2_8daaf6152771_2cde20de78fc", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1509h2", "b": "8daaf6152771", "c": "2cde20de78fc", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-65281-16-65037-0-13-18-11-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790712421, "last_seen": 1790712421, "transport": "t", "ja3_hash": "4da11827670a6fd4e36e7e82d1a83834", "ja3_variant_count": 1, "ja3_variants": [ "4da11827670a6fd4e36e7e82d1a83834" ], "user_agents": { "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36": 4 }, "ua_disagreement": false } }, { "hash": "t12d1509h2_8daaf6152771_35f91b7320c6", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1509h2", "b": "8daaf6152771", "c": "35f91b7320c6", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-16-27-65281-11-35-65037-45-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790023816, "last_seen": 1790023816, "transport": "t", "ja3_hash": "533ac640840c3ea926f6578de9198820", "ja3_variant_count": 1, "ja3_variants": [ "533ac640840c3ea926f6578de9198820" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d1509h2_8daaf6152771_686ce6f72082", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1509h2", "b": "8daaf6152771", "c": "686ce6f72082", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-11-16-0-27-13-23-65037-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789174733, "last_seen": 1789174733, "transport": "t", "ja3_hash": "bf68021036d497927ee4cea6b1cff60b", "ja3_variant_count": 1, "ja3_variants": [ "bf68021036d497927ee4cea6b1cff60b" ], "user_agents": { "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36": 16 }, "ua_disagreement": false } }, { "hash": "t12d1509h2_8daaf6152771_691bf9aa189e", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1509h2", "b": "8daaf6152771", "c": "691bf9aa189e", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-16-23-27-17613-65037-0-11-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790591322, "last_seen": 1790591322, "transport": "t", "ja3_hash": "a829ab7fbc24075515098b37b082d918", "ja3_variant_count": 1, "ja3_variants": [ "a829ab7fbc24075515098b37b082d918" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36": 6 }, "ua_disagreement": false } }, { "hash": "t12d1509h2_8daaf6152771_6a0fb5f56cc2", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1509h2", "b": "8daaf6152771", "c": "6a0fb5f56cc2", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-16-17613-51764-65037-5-0-45-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789729275, "last_seen": 1789729275, "transport": "t", "ja3_hash": "a6385fbfb1bc90baa59c05c4953c2ac3", "ja3_variant_count": 1, "ja3_variants": [ "a6385fbfb1bc90baa59c05c4953c2ac3" ], "user_agents": { "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d1509h2_8daaf6152771_6bdbc9c1c134", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1509h2", "b": "8daaf6152771", "c": "6bdbc9c1c134", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-18-65281-13-23-16-35-0-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790002286, "last_seen": 1790002286, "transport": "t", "ja3_hash": "58248f9d8f9797c2ed71df9d8592c34c", "ja3_variant_count": 1, "ja3_variants": [ "58248f9d8f9797c2ed71df9d8592c34c" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36 Edg/153.0.0.0": 15 }, "ua_disagreement": false } }, { "hash": "t12d1509h2_8daaf6152771_770a71c7b0bb", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1509h2", "b": "8daaf6152771", "c": "770a71c7b0bb", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-35-27-65037-65281-13-0-10-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791154057, "last_seen": 1791154057, "transport": "t", "ja3_hash": "77f9fae793c179ce4778ad6b72c18887", "ja3_variant_count": 1, "ja3_variants": [ "77f9fae793c179ce4778ad6b72c18887" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36": 2 }, "ua_disagreement": false } }, { "hash": "t12d1509h2_8daaf6152771_799252e9e7a3", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1509h2", "b": "8daaf6152771", "c": "799252e9e7a3", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-18-16-13-0-45-11-10-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790247337, "last_seen": 1790247337, "transport": "t", "ja3_hash": "835757127f55ec995c960d337b6956f6", "ja3_variant_count": 1, "ja3_variants": [ "835757127f55ec995c960d337b6956f6" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d1509h2_8daaf6152771_79b61c583d29", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1509h2", "b": "8daaf6152771", "c": "79b61c583d29", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-0-35-27-23-45-16-65281-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790163195, "last_seen": 1790163195, "transport": "t", "ja3_hash": "b4d4dbe9a88bc9b7fbb684379c75e137", "ja3_variant_count": 1, "ja3_variants": [ "b4d4dbe9a88bc9b7fbb684379c75e137" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d1509h2_8daaf6152771_7a850863f715", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1509h2", "b": "8daaf6152771", "c": "7a850863f715", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-0-11-17613-16-10-5-65037-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788761155, "last_seen": 1788761155, "transport": "t", "ja3_hash": "4f0d76e6a57342a4a536dc0185593dde", "ja3_variant_count": 1, "ja3_variants": [ "4f0d76e6a57342a4a536dc0185593dde" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12d1509h2_8daaf6152771_7fca69506369", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1509h2", "b": "8daaf6152771", "c": "7fca69506369", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-16-45-11-0-10-51764-23-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790862341, "last_seen": 1790862341, "transport": "t", "ja3_hash": "297875b36e1c687d9ad3d55bcb9c7732", "ja3_variant_count": 1, "ja3_variants": [ "297875b36e1c687d9ad3d55bcb9c7732" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 5 }, "ua_disagreement": false } }, { "hash": "t12d1509h2_8daaf6152771_8c6b904f3484", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1509h2", "b": "8daaf6152771", "c": "8c6b904f3484", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-65281-17613-23-0-35-45-16-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789601226, "last_seen": 1789601226, "transport": "t", "ja3_hash": "0b9324967dc6a46fee17adefd53dda10", "ja3_variant_count": 1, "ja3_variants": [ "0b9324967dc6a46fee17adefd53dda10" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d1509h2_8daaf6152771_a1f3eea8f9b4", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1509h2", "b": "8daaf6152771", "c": "a1f3eea8f9b4", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-16-23-13-0-17613-11-27-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790146140, "last_seen": 1790146140, "transport": "t", "ja3_hash": "6207a5e2b213634f5470d811377a965f", "ja3_variant_count": 1, "ja3_variants": [ "6207a5e2b213634f5470d811377a965f" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d1509h2_8daaf6152771_a350aa7bad96", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1509h2", "b": "8daaf6152771", "c": "a350aa7bad96", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-5-0-23-16-27-18-65281-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790232461, "last_seen": 1790232461, "transport": "t", "ja3_hash": "3a6c1a42e561fcb7194f1b3bb5cb1dff", "ja3_variant_count": 1, "ja3_variants": [ "3a6c1a42e561fcb7194f1b3bb5cb1dff" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d1509h2_8daaf6152771_a41ea4043d9d", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1509h2", "b": "8daaf6152771", "c": "a41ea4043d9d", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-16-10-5-0-13-65037-45-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791269741, "last_seen": 1791269741, "transport": "t", "ja3_hash": "8a9234fd74a7472d76436c7437ee8f9f", "ja3_variant_count": 1, "ja3_variants": [ "8a9234fd74a7472d76436c7437ee8f9f" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0 Safari/537.36 Edg/135.0.0": 2 }, "ua_disagreement": false } }, { "hash": "t12d1509h2_8daaf6152771_a88f965fb6ec", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1509h2", "b": "8daaf6152771", "c": "a88f965fb6ec", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-17613-65037-16-13-10-65281-0-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790192973, "last_seen": 1790192973, "transport": "t", "ja3_hash": "a5f126b628127f97f7ac02d90565baf7", "ja3_variant_count": 1, "ja3_variants": [ "a5f126b628127f97f7ac02d90565baf7" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d1509h2_8daaf6152771_ac81127c1fe2", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1509h2", "b": "8daaf6152771", "c": "ac81127c1fe2", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-35-65037-17613-0-11-16-65281-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788620744, "last_seen": 1788620744, "transport": "t", "ja3_hash": "502c4890227aa9162dc55fbda8bad950", "ja3_variant_count": 1, "ja3_variants": [ "502c4890227aa9162dc55fbda8bad950" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 4 }, "ua_disagreement": false } }, { "hash": "t12d1509h2_8daaf6152771_af4000ee41b1", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1509h2", "b": "8daaf6152771", "c": "af4000ee41b1", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-13-18-45-11-16-23-0-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788964846, "last_seen": 1788964846, "transport": "t", "ja3_hash": "5471b17efce41b83d483ee5ad5d224ed", "ja3_variant_count": 1, "ja3_variants": [ "5471b17efce41b83d483ee5ad5d224ed" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12d1509h2_8daaf6152771_b379a0bbbf75", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1509h2", "b": "8daaf6152771", "c": "b379a0bbbf75", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-5-45-23-16-65281-18-0-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790198254, "last_seen": 1790198254, "transport": "t", "ja3_hash": "26972c796389cefaf433ba611e90e5ed", "ja3_variant_count": 1, "ja3_variants": [ "26972c796389cefaf433ba611e90e5ed" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d1509h2_8daaf6152771_b5c435c068e0", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1509h2", "b": "8daaf6152771", "c": "b5c435c068e0", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-10-23-45-13-5-0-65281-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789688737, "last_seen": 1789688737, "transport": "t", "ja3_hash": "0426bae1ce4a38bf334aa5f742438f35", "ja3_variant_count": 1, "ja3_variants": [ "0426bae1ce4a38bf334aa5f742438f35" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12d1509h2_8daaf6152771_c6b1596e1861", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1509h2", "b": "8daaf6152771", "c": "c6b1596e1861", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-13-16-65281-11-0-10-35-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790890898, "last_seen": 1790890898, "transport": "t", "ja3_hash": "4d17a61bab12fb386618a73c8c087edd", "ja3_variant_count": 1, "ja3_variants": [ "4d17a61bab12fb386618a73c8c087edd" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 10 }, "ua_disagreement": false } }, { "hash": "t12d1509h2_8daaf6152771_dce171efc0aa", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1509h2", "b": "8daaf6152771", "c": "dce171efc0aa", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-5-11-0-65037-16-18-10-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 5, "name": "status_request", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791280356, "last_seen": 1791280356, "transport": "t", "ja3_hash": "0f61f8aab1600cb82177ff6d639d02a6", "ja3_variant_count": 1, "ja3_variants": [ "0f61f8aab1600cb82177ff6d639d02a6" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 7 }, "ua_disagreement": false } }, { "hash": "t12d1509h2_8daaf6152771_e1b700f7b166", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1509h2", "b": "8daaf6152771", "c": "e1b700f7b166", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-16-18-11-27-17613-51-0-43,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 43, "name": "supported_versions", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790244213, "last_seen": 1790244213, "transport": "t", "ja3_hash": "4bcd7feda80e96957289ab6a2f92333f", "ja3_variant_count": 1, "ja3_variants": [ "4bcd7feda80e96957289ab6a2f92333f" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d1509h2_8daaf6152771_e4256b3fbde5", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1509h2", "b": "8daaf6152771", "c": "e4256b3fbde5", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-13-16-35-10-11-18-17613-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790722563, "last_seen": 1790722563, "transport": "t", "ja3_hash": "0f62f4db8acf65bba17e6e31b44fd6e2", "ja3_variant_count": 1, "ja3_variants": [ "0f62f4db8acf65bba17e6e31b44fd6e2" ], "user_agents": { "Mozilla/5.0 (Linux; Android 15; CPH2653) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Mobile Safari/537.36": 2 }, "ua_disagreement": false } }, { "hash": "t12d1509h2_8daaf6152771_e612fdce8799", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1509h2", "b": "8daaf6152771", "c": "e612fdce8799", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-0-65037-16-35-5-65281-13-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790521860, "last_seen": 1790521860, "transport": "t", "ja3_hash": "7c40a455c5ab9a19d457f564ca4a8001", "ja3_variant_count": 1, "ja3_variants": [ "7c40a455c5ab9a19d457f564ca4a8001" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d1509h2_8daaf6152771_e941755b183a", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1509h2", "b": "8daaf6152771", "c": "e941755b183a", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-5-65281-27-0-16-51-18-11,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789730597, "last_seen": 1789730597, "transport": "t", "ja3_hash": "870f7e0cceac5851e494ca7e08effcac", "ja3_variant_count": 1, "ja3_variants": [ "870f7e0cceac5851e494ca7e08effcac" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 10 }, "ua_disagreement": false } }, { "hash": "t12d1509h2_8daaf6152771_e98aeb888944", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1509h2", "b": "8daaf6152771", "c": "e98aeb888944", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-35-17613-10-65037-45-0-16-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789006187, "last_seen": 1789006187, "transport": "t", "ja3_hash": "c8e6d8af0fb240a02ea5395c3de92ebd", "ja3_variant_count": 1, "ja3_variants": [ "c8e6d8af0fb240a02ea5395c3de92ebd" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12d1509h2_8daaf6152771_f03bc0c113ee", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1509h2", "b": "8daaf6152771", "c": "f03bc0c113ee", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-45-16-17613-0-13-5-65281-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789021791, "last_seen": 1789021791, "transport": "t", "ja3_hash": "ed8829eddf9ce9e9f256220e800a9374", "ja3_variant_count": 1, "ja3_variants": [ "ed8829eddf9ce9e9f256220e800a9374" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12d1509h2_8daaf6152771_f3a98b490cb5", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1509h2", "b": "8daaf6152771", "c": "f3a98b490cb5", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-23-18-5-10-65281-0-11-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789782419, "last_seen": 1789782419, "transport": "t", "ja3_hash": "150ccf2667f442dba4703a9e122c3f63", "ja3_variant_count": 1, "ja3_variants": [ "150ccf2667f442dba4703a9e122c3f63" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36 Edg/153.0.0.0": 4 }, "ua_disagreement": false } }, { "hash": "t12d1509h2_8daaf6152771_f8ad27f241e1", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1509h2", "b": "8daaf6152771", "c": "f8ad27f241e1", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-5-45-23-0-65281-10-18-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790379170, "last_seen": 1790379170, "transport": "t", "ja3_hash": "e63d6ed313c6835bc1d75e4c49d0af5d", "ja3_variant_count": 1, "ja3_variants": [ "e63d6ed313c6835bc1d75e4c49d0af5d" ], "user_agents": { "Mozilla/5.0 (Linux; Android 15; Pixel 9) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Mobile Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d1509h2_8daaf6152771_fef43cc4674a", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Firefox \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1509h2", "b": "8daaf6152771", "c": "fef43cc4674a", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 9, "alpn": "h2" } }, "ja3_string": "771,4865-4867-4866-49195-49199-52393-52392-49196-49200-49171-49172-156-157-47-53,0-23-65281-10-11-16-34-18-51,4588-29-23-24-25-514,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 34, "name": "34 (0x0022)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 514, "name": "514 (0x0202)", "known": false } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 3, "first_seen": 1791149125, "last_seen": 1791149126, "transport": "t", "ja3_hash": "106528a2c0339b5abdf384589fec7b28", "ja3_variant_count": 1, "ja3_variants": [ "106528a2c0339b5abdf384589fec7b28" ], "user_agents": { "Mozilla/5.0 (X11; Linux x86_64; rv:157.0) Gecko/20100101 Firefox/157.0": 11 }, "ua_disagreement": false } }, { "hash": "t12d151000_8daaf6152771_0461c316b52e", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d151000", "b": "8daaf6152771", "c": "0461c316b52e", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-35-17613-65281-13-27-45-0-65037-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790775690, "last_seen": 1790775690, "transport": "t", "ja3_hash": "6f5e52d4c5a9919d7b4e529425f19792", "ja3_variant_count": 1, "ja3_variants": [ "6f5e52d4c5a9919d7b4e529425f19792" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36": 19 }, "ua_disagreement": false } }, { "hash": "t12d151000_8daaf6152771_1babfa30d4b5", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d151000", "b": "8daaf6152771", "c": "1babfa30d4b5", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-65037-5-13-35-17613-45-0-65281-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790191929, "last_seen": 1790191929, "transport": "t", "ja3_hash": "8d22df7649c61bde1087b376dcf64834", "ja3_variant_count": 1, "ja3_variants": [ "8d22df7649c61bde1087b376dcf64834" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d151000_8daaf6152771_1caa206ee25a", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d151000", "b": "8daaf6152771", "c": "1caa206ee25a", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-51-23-27-17613-18-35-10-45-16,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789442122, "last_seen": 1789442122, "transport": "t", "ja3_hash": "548eaccfe70bf325139c66473765ef19", "ja3_variant_count": 1, "ja3_variants": [ "548eaccfe70bf325139c66473765ef19" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 Edg/152.0.0.0": 12 }, "ua_disagreement": false } }, { "hash": "t12d151000_8daaf6152771_1e13e803bf3a", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d151000", "b": "8daaf6152771", "c": "1e13e803bf3a", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-18-17613-27-11-65281-35-13-0-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 2, "first_seen": 1790162096, "last_seen": 1790247052, "transport": "t", "ja3_hash": "4c89c1c2dc43fe1d0aba3fb94232fe98", "ja3_variant_count": 2, "ja3_variants": [ "4c89c1c2dc43fe1d0aba3fb94232fe98", "71fb33d10db3c075130ae87c1d76c2c9" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36": 4, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d151000_8daaf6152771_32ec49e0152b", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d151000", "b": "8daaf6152771", "c": "32ec49e0152b", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-5-65281-27-23-45-10-13-65037-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789829909, "last_seen": 1789829909, "transport": "t", "ja3_hash": "d27f61046c32e10a4b3a309042773ef8", "ja3_variant_count": 1, "ja3_variants": [ "d27f61046c32e10a4b3a309042773ef8" ], "user_agents": { "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Mobile Safari/537.36": 13 }, "ua_disagreement": false } }, { "hash": "t12d151000_8daaf6152771_3853f111b26c", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d151000", "b": "8daaf6152771", "c": "3853f111b26c", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-5-65037-65281-45-18-35-11-27-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790770769, "last_seen": 1790770769, "transport": "t", "ja3_hash": "623de4f17721d3745adcdcd785770e26", "ja3_variant_count": 1, "ja3_variants": [ "623de4f17721d3745adcdcd785770e26" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Edg/134.0.0.0": 16 }, "ua_disagreement": false } }, { "hash": "t12d151000_8daaf6152771_50df405ffc38", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d151000", "b": "8daaf6152771", "c": "50df405ffc38", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-5-10-45-17613-18-51764-0-65037-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 0, "name": "server_name", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789568902, "last_seen": 1789568902, "transport": "t", "ja3_hash": "89d41c9eb46510fbfcc31b43edc03aea", "ja3_variant_count": 1, "ja3_variants": [ "89d41c9eb46510fbfcc31b43edc03aea" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 15 }, "ua_disagreement": false } }, { "hash": "t12d151000_8daaf6152771_50ec25b9ab97", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d151000", "b": "8daaf6152771", "c": "50ec25b9ab97", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-13-27-5-65037-0-65281-35-45-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788835209, "last_seen": 1788835209, "transport": "t", "ja3_hash": "0873ab450e550d7e25e3984cc8a7d496", "ja3_variant_count": 1, "ja3_variants": [ "0873ab450e550d7e25e3984cc8a7d496" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d151000_8daaf6152771_5aa78f95313a", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d151000", "b": "8daaf6152771", "c": "5aa78f95313a", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-10-65281-23-27-17613-0-45-35-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 0, "name": "server_name", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790658025, "last_seen": 1790658025, "transport": "t", "ja3_hash": "bbc156b0973cb6758e5a771298a65d0d", "ja3_variant_count": 1, "ja3_variants": [ "bbc156b0973cb6758e5a771298a65d0d" ], "user_agents": { "Mozilla/5.0 (iPhone; CPU iPhone OS 11_0 like Mac OS X) AppleWebKit/604.1.38 (KHTML, like Gecko) Version/26.5 Mobile/15A372 Safari/604.1": 6 }, "ua_disagreement": false } }, { "hash": "t12d151000_8daaf6152771_6a4773a3e5d8", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d151000", "b": "8daaf6152771", "c": "6a4773a3e5d8", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-65037-27-5-10-0-45-11-13-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788999849, "last_seen": 1788999849, "transport": "t", "ja3_hash": "d6e32c76728accabd2077abb68a3aa09", "ja3_variant_count": 1, "ja3_variants": [ "d6e32c76728accabd2077abb68a3aa09" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12d151000_8daaf6152771_6c3d70de8c89", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d151000", "b": "8daaf6152771", "c": "6c3d70de8c89", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-27-18-13-11-65281-45-23-0-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790833971, "last_seen": 1790833971, "transport": "t", "ja3_hash": "933933c4044737bde5a66c8bc9178aad", "ja3_variant_count": 1, "ja3_variants": [ "933933c4044737bde5a66c8bc9178aad" ], "user_agents": { "Mozilla/5.0 (Linux; Android 14; Pixel 8 Pro) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d151000_8daaf6152771_71adf8533273", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d151000", "b": "8daaf6152771", "c": "71adf8533273", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-51764-65281-17613-13-23-65037-0-45-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791174606, "last_seen": 1791174606, "transport": "t", "ja3_hash": "3565288e3fe6ba449693181de043ea1c", "ja3_variant_count": 1, "ja3_variants": [ "3565288e3fe6ba449693181de043ea1c" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36": 12 }, "ua_disagreement": false } }, { "hash": "t12d151000_8daaf6152771_737af06f94cf", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d151000", "b": "8daaf6152771", "c": "737af06f94cf", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-0-27-11-65037-18-10-13-65281-51,25497-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 25497, "name": "X25519Kyber768Draft00", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789966771, "last_seen": 1789966771, "transport": "t", "ja3_hash": "261485000f25201e79cc3306722a6429", "ja3_variant_count": 1, "ja3_variants": [ "261485000f25201e79cc3306722a6429" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d151000_8daaf6152771_914e2698c591", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d151000", "b": "8daaf6152771", "c": "914e2698c591", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-27-45-23-13-17613-65037-0-18-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790148072, "last_seen": 1790148072, "transport": "t", "ja3_hash": "33467ab0656f148a4a37324ebaaf30f7", "ja3_variant_count": 1, "ja3_variants": [ "33467ab0656f148a4a37324ebaaf30f7" ], "user_agents": { "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 16 }, "ua_disagreement": false } }, { "hash": "t12d151000_8daaf6152771_93417795e1d8", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d151000", "b": "8daaf6152771", "c": "93417795e1d8", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-17613-23-0-11-65281-10-18-13-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790789321, "last_seen": 1790789321, "transport": "t", "ja3_hash": "aaa8c57f5878fb12a0296165ea9a5f48", "ja3_variant_count": 1, "ja3_variants": [ "aaa8c57f5878fb12a0296165ea9a5f48" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d151000_8daaf6152771_a195a0d0cfe8", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d151000", "b": "8daaf6152771", "c": "a195a0d0cfe8", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-11-65037-13-0-17613-35-18-27-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790076985, "last_seen": 1790076985, "transport": "t", "ja3_hash": "3bc2ba9a78d88c6576a1cce3e8ae5c80", "ja3_variant_count": 1, "ja3_variants": [ "3bc2ba9a78d88c6576a1cce3e8ae5c80" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 10 }, "ua_disagreement": false } }, { "hash": "t12d151000_8daaf6152771_a47e054fef0d", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d151000", "b": "8daaf6152771", "c": "a47e054fef0d", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-45-17613-27-35-51764-11-23-18-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788948713, "last_seen": 1788948713, "transport": "t", "ja3_hash": "c2d4fcad7b13d4622c536dc3605345e9", "ja3_variant_count": 1, "ja3_variants": [ "c2d4fcad7b13d4622c536dc3605345e9" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 5 }, "ua_disagreement": false } }, { "hash": "t12d151000_8daaf6152771_aa03fc3fc3c8", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d151000", "b": "8daaf6152771", "c": "aa03fc3fc3c8", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-10-18-65037-45-65281-5-13-0-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790995541, "last_seen": 1790995541, "transport": "t", "ja3_hash": "b4e94e342d70c56e160f402996a07710", "ja3_variant_count": 1, "ja3_variants": [ "b4e94e342d70c56e160f402996a07710" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 10 }, "ua_disagreement": false } }, { "hash": "t12d151000_8daaf6152771_acc63b9b52bf", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d151000", "b": "8daaf6152771", "c": "acc63b9b52bf", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-17613-11-27-13-5-0-45-18-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791152277, "last_seen": 1791152277, "transport": "t", "ja3_hash": "3ec049d3df59f5d9bb1ea14b12224194", "ja3_variant_count": 1, "ja3_variants": [ "3ec049d3df59f5d9bb1ea14b12224194" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36": 2 }, "ua_disagreement": false } }, { "hash": "t12d151000_8daaf6152771_c7bb39056392", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d151000", "b": "8daaf6152771", "c": "c7bb39056392", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-65037-35-11-45-5-65281-27-0-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788767383, "last_seen": 1788767383, "transport": "t", "ja3_hash": "9edfca88725a1b70e047a0513e0ddab8", "ja3_variant_count": 1, "ja3_variants": [ "9edfca88725a1b70e047a0513e0ddab8" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12d151000_8daaf6152771_cea9b4acbcf2", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d151000", "b": "8daaf6152771", "c": "cea9b4acbcf2", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-10-13-35-23-0-27-18-45-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790212085, "last_seen": 1790212085, "transport": "t", "ja3_hash": "f5bb0a7319b78bdc6b3e22cdc5d89920", "ja3_variant_count": 1, "ja3_variants": [ "f5bb0a7319b78bdc6b3e22cdc5d89920" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d151000_8daaf6152771_d29fab0cc7c5", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d151000", "b": "8daaf6152771", "c": "d29fab0cc7c5", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-51-23-65281-18-0-27-17513-65037-35,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 17513, "name": "application_settings", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 35, "name": "session_ticket", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791284243, "last_seen": 1791284243, "transport": "t", "ja3_hash": "410329ed7da557d918a2b5b83bcddd4d", "ja3_variant_count": 1, "ja3_variants": [ "410329ed7da557d918a2b5b83bcddd4d" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d151000_8daaf6152771_d2de718e32cf", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d151000", "b": "8daaf6152771", "c": "d2de718e32cf", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-35-13-65281-0-65037-11-18-5-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790186246, "last_seen": 1790186246, "transport": "t", "ja3_hash": "a11be728dc66f6388011ad8331e37cd8", "ja3_variant_count": 1, "ja3_variants": [ "a11be728dc66f6388011ad8331e37cd8" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d151000_8daaf6152771_db4190d02fcf", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d151000", "b": "8daaf6152771", "c": "db4190d02fcf", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-27-10-65037-65281-17613-13-35-0-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790997867, "last_seen": 1790997867, "transport": "t", "ja3_hash": "fddcc3d9363bd4230179777e4d772fb0", "ja3_variant_count": 1, "ja3_variants": [ "fddcc3d9363bd4230179777e4d772fb0" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 11_0_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.1.0 Safari/537.36 Edg/129.1.0": 2 }, "ua_disagreement": false } }, { "hash": "t12d151000_8daaf6152771_e9de89ee8a89", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d151000", "b": "8daaf6152771", "c": "e9de89ee8a89", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-0-5-65281-13-17613-35-10-11-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788723896, "last_seen": 1788723896, "transport": "t", "ja3_hash": "fd75745c911779cbb9ba17d8bcf6700c", "ja3_variant_count": 1, "ja3_variants": [ "fd75745c911779cbb9ba17d8bcf6700c" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 6 }, "ua_disagreement": false } }, { "hash": "t12d151000_8daaf6152771_fd15b84c3250", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d151000", "b": "8daaf6152771", "c": "fd15b84c3250", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-35-45-65037-0-27-17613-11-65281-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 2, "first_seen": 1789949055, "last_seen": 1790436009, "transport": "t", "ja3_hash": "c5f0dc50e5ae3bc83368d15b4f34d35c", "ja3_variant_count": 2, "ja3_variants": [ "c5f0dc50e5ae3bc83368d15b4f34d35c", "83f5e6d3c02acc2831ef192e7e6ab0d8" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; https://zhanzhang.toutiao.com/)": 1, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/146.0.7680.165 Safari/537.36": 1 }, "ua_disagreement": true } }, { "hash": "t12d151000_8daaf6152771_fd58ce490f58", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d151000", "b": "8daaf6152771", "c": "fd58ce490f58", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51764-13-10-45-65281-17613-35-11-0-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790948091, "last_seen": 1790948091, "transport": "t", "ja3_hash": "5cc8d107012489433b9e3835fa7eeb2f", "ja3_variant_count": 1, "ja3_variants": [ "5cc8d107012489433b9e3835fa7eeb2f" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36": 17 }, "ua_disagreement": false } }, { "hash": "t12d151000_8daaf6152771_fecad6b9bc17", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d151000", "b": "8daaf6152771", "c": "fecad6b9bc17", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-5-0-13-18-23-10-65037-35-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791193514, "last_seen": 1791193514, "transport": "t", "ja3_hash": "8555bc4f0ee69a5aaf58d1744142ed4b", "ja3_variant_count": 1, "ja3_variants": [ "8555bc4f0ee69a5aaf58d1744142ed4b" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36": 2 }, "ua_disagreement": false } }, { "hash": "t12d1510h1_8daaf6152771_1bdb9f85c253", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1510h1", "b": "8daaf6152771", "c": "1bdb9f85c253", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": "h1" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-18-11-10-16-23-0-27-45-51,25497-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 25497, "name": "X25519Kyber768Draft00", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790657107, "last_seen": 1790657107, "transport": "t", "ja3_hash": "abc52fbba54eade750098e73e4c36166", "ja3_variant_count": 1, "ja3_variants": [ "abc52fbba54eade750098e73e4c36166" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d1510h1_8daaf6152771_844ac5fd46f7", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1510h1", "b": "8daaf6152771", "c": "844ac5fd46f7", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": "h1" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-0-16-11-23-10-45-27-18-51,25497-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 25497, "name": "X25519Kyber768Draft00", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790570142, "last_seen": 1790570142, "transport": "t", "ja3_hash": "f936cb3f3f2adc85d3bcec4e12596db8", "ja3_variant_count": 1, "ja3_variants": [ "f936cb3f3f2adc85d3bcec4e12596db8" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d1510h1_8daaf6152771_c253c1f5231f", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1510h1", "b": "8daaf6152771", "c": "c253c1f5231f", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": "h1" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-27-23-65281-18-35-45-0-16-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790524860, "last_seen": 1790524860, "transport": "t", "ja3_hash": "24a8d15340c38e0fea1cacf3b2048737", "ja3_variant_count": 1, "ja3_variants": [ "24a8d15340c38e0fea1cacf3b2048737" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d1510h1_8daaf6152771_e99b8dce5de5", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1510h1", "b": "8daaf6152771", "c": "e99b8dce5de5", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": "h1" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-45-16-13-5-27-65037-0-10-51,25497-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 25497, "name": "X25519Kyber768Draft00", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790992401, "last_seen": 1790992401, "transport": "t", "ja3_hash": "9b68ad2e0118c2441c6d98ca40f1ed5d", "ja3_variant_count": 1, "ja3_variants": [ "9b68ad2e0118c2441c6d98ca40f1ed5d" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d1510h2_8daaf6152771_02a9c5e19149", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1510h2", "b": "8daaf6152771", "c": "02a9c5e19149", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-5-18-13-11-10-16-17613-65037-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 2, "first_seen": 1790366323, "last_seen": 1791221450, "transport": "t", "ja3_hash": "f5525218af1da8a4f844bd522cb5409a", "ja3_variant_count": 2, "ja3_variants": [ "f5525218af1da8a4f844bd522cb5409a", "baa6436223243e58619ffcde91f66e2e" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 20 }, "ua_disagreement": false } }, { "hash": "t12d1510h2_8daaf6152771_031582c82bea", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1510h2", "b": "8daaf6152771", "c": "031582c82bea", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-0-45-35-11-13-16-17613-27-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791198069, "last_seen": 1791198069, "transport": "t", "ja3_hash": "e0a87a3c6403a8b7d7aaeaa3bfee6ac0", "ja3_variant_count": 1, "ja3_variants": [ "e0a87a3c6403a8b7d7aaeaa3bfee6ac0" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36": 8 }, "ua_disagreement": false } }, { "hash": "t12d1510h2_8daaf6152771_064c7ff5e0dd", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1510h2", "b": "8daaf6152771", "c": "064c7ff5e0dd", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-65281-0-16-65037-27-17613-13-11-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789443929, "last_seen": 1789443929, "transport": "t", "ja3_hash": "7ff6673fe3fb9ee31b1103715437a62a", "ja3_variant_count": 1, "ja3_variants": [ "7ff6673fe3fb9ee31b1103715437a62a" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 Edg/152.0.0.0": 150 }, "ua_disagreement": false } }, { "hash": "t12d1510h2_8daaf6152771_06570b0347c1", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1510h2", "b": "8daaf6152771", "c": "06570b0347c1", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-65037-27-18-16-45-23-0-5-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791249079, "last_seen": 1791249079, "transport": "t", "ja3_hash": "f1e88f67e9636f45b2feeb55dd8fa95a", "ja3_variant_count": 1, "ja3_variants": [ "f1e88f67e9636f45b2feeb55dd8fa95a" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36 Edg/154.0.0.0": 2 }, "ua_disagreement": false } }, { "hash": "t12d1510h2_8daaf6152771_06e76ed2b220", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1510h2", "b": "8daaf6152771", "c": "06e76ed2b220", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-18-5-0-65281-11-10-13-16-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790029244, "last_seen": 1790029244, "transport": "t", "ja3_hash": "fa36ab703c1e7c2b8d3355b2bdc6b51b", "ja3_variant_count": 1, "ja3_variants": [ "fa36ab703c1e7c2b8d3355b2bdc6b51b" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d1510h2_8daaf6152771_0821d44e3287", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1510h2", "b": "8daaf6152771", "c": "0821d44e3287", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-0-11-65037-16-17613-10-35-18-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788668738, "last_seen": 1788668738, "transport": "t", "ja3_hash": "79b3bda7013444ac89ef4ed46c02f27b", "ja3_variant_count": 1, "ja3_variants": [ "79b3bda7013444ac89ef4ed46c02f27b" ], "user_agents": { "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36": 11 }, "ua_disagreement": false } }, { "hash": "t12d1510h2_8daaf6152771_0b2abafb1035", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1510h2", "b": "8daaf6152771", "c": "0b2abafb1035", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-13-18-65281-27-0-10-11-45-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790211128, "last_seen": 1790211128, "transport": "t", "ja3_hash": "a050758d20e748e66890d5010d7fc92e", "ja3_variant_count": 1, "ja3_variants": [ "a050758d20e748e66890d5010d7fc92e" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d1510h2_8daaf6152771_1eaf60c563e4", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1510h2", "b": "8daaf6152771", "c": "1eaf60c563e4", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-16-45-10-0-18-23-27-13-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789432687, "last_seen": 1789432687, "transport": "t", "ja3_hash": "3594a2b3e583321bfa7ca2bbd9c54625", "ja3_variant_count": 1, "ja3_variants": [ "3594a2b3e583321bfa7ca2bbd9c54625" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 10 }, "ua_disagreement": false } }, { "hash": "t12d1510h2_8daaf6152771_24d6e2264cdf", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1510h2", "b": "8daaf6152771", "c": "24d6e2264cdf", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-5-16-27-18-17613-0-23-45-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790191991, "last_seen": 1790191991, "transport": "t", "ja3_hash": "9750109ff41c1991ec65fd62eb4942e6", "ja3_variant_count": 1, "ja3_variants": [ "9750109ff41c1991ec65fd62eb4942e6" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d1510h2_8daaf6152771_28547a9047bf", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1510h2", "b": "8daaf6152771", "c": "28547a9047bf", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-16-11-35-51764-45-0-5-17613-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790788068, "last_seen": 1790788068, "transport": "t", "ja3_hash": "3f9989a0ca7a1c246bebe361071503bb", "ja3_variant_count": 1, "ja3_variants": [ "3f9989a0ca7a1c246bebe361071503bb" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 7 }, "ua_disagreement": false } }, { "hash": "t12d1510h2_8daaf6152771_28c7080823c8", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1510h2", "b": "8daaf6152771", "c": "28c7080823c8", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-0-17613-16-23-65037-35-18-5-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789750606, "last_seen": 1789750606, "transport": "t", "ja3_hash": "f7e6b92ae9d7965ee14af40e5b572d5d", "ja3_variant_count": 1, "ja3_variants": [ "f7e6b92ae9d7965ee14af40e5b572d5d" ], "user_agents": { "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Mobile Safari/537.36": 6 }, "ua_disagreement": false } }, { "hash": "t12d1510h2_8daaf6152771_29cc5cd76a4e", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1510h2", "b": "8daaf6152771", "c": "29cc5cd76a4e", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-11-65281-0-10-27-16-23-18-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789028565, "last_seen": 1789028565, "transport": "t", "ja3_hash": "b55fae2ba58bbefb22741483ddd926ad", "ja3_variant_count": 1, "ja3_variants": [ "b55fae2ba58bbefb22741483ddd926ad" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12d1510h2_8daaf6152771_308c9f3e9479", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1510h2", "b": "8daaf6152771", "c": "308c9f3e9479", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-0-51764-10-27-35-16-5-13-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790517582, "last_seen": 1790517582, "transport": "t", "ja3_hash": "cef43f00081c3a32d9371b0505c82bea", "ja3_variant_count": 1, "ja3_variants": [ "cef43f00081c3a32d9371b0505c82bea" ], "user_agents": { "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Mobile Safari/537.36": 3 }, "ua_disagreement": false } }, { "hash": "t12d1510h2_8daaf6152771_31641c40bd40", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1510h2", "b": "8daaf6152771", "c": "31641c40bd40", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-16-13-10-23-65281-17613-18-0-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 2, "first_seen": 1788784803, "last_seen": 1788797452, "transport": "t", "ja3_hash": "fe50377a9a20b931d9889034734edad2", "ja3_variant_count": 2, "ja3_variants": [ "fe50377a9a20b931d9889034734edad2", "47883dc56d38baab9b23c18ad69db801" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; https://zhanzhang.toutiao.com/)": 3, "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12d1510h2_8daaf6152771_4a065df55c19", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Firefox \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1510h2", "b": "8daaf6152771", "c": "4a065df55c19", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4867-4866-49195-49199-52393-52392-49196-49200-49171-49172-156-157-47-53,0-23-65281-10-11-16-5-34-18-51,4588-29-23-24-25-256-257,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 34, "name": "34 (0x0022)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 620, "first_seen": 1787516558, "last_seen": 1791310674, "transport": "t", "ja3_hash": "0b0b8d5f87b0a48ba36914bcef2ea47e", "ja3_variant_count": 4, "ja3_variants": [ "0b0b8d5f87b0a48ba36914bcef2ea47e", "3f18d0aaf5dfc64f9be3aa1d568a9189", "4f1e1af5ffb803ceceae1d62ae8fa94e", "fbd433fde8893fc8c32fe9c7bf9b1204" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:154.0) Gecko/20100101 Firefox/154.0": 892, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:154.0) Gecko/20100101 Firefox/154.0": 180, "Mozilla/5.0 (X11; Linux x86_64; rv:154.0) Gecko/20100101 Firefox/154.0": 127, "Mozilla/5.0 (Android 16; Mobile; rv:156.0) Gecko/156.0 Firefox/156.0": 9, "Mozilla/5.0 (Android 16; Mobile; rv:157.0) Gecko/157.0 Firefox/157.0": 43, "Mozilla/5.0 (X11; Linux x86_64; rv:156.0) Gecko/20100101 Firefox/156.0": 94, "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:155.0) Gecko/20100101 Firefox/155.0": 15, "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:156.0) Gecko/20100101 Firefox/156.0": 3 }, "ua_disagreement": false } }, { "hash": "t12d1510h2_8daaf6152771_4dbab9fbff62", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1510h2", "b": "8daaf6152771", "c": "4dbab9fbff62", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-65281-11-5-13-0-16-23-35-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790910304, "last_seen": 1790910304, "transport": "t", "ja3_hash": "b04ac46491e9cc34411c15c4bb5f73c4", "ja3_variant_count": 1, "ja3_variants": [ "b04ac46491e9cc34411c15c4bb5f73c4" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 9 }, "ua_disagreement": false } }, { "hash": "t12d1510h2_8daaf6152771_4e728f0ca327", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1510h2", "b": "8daaf6152771", "c": "4e728f0ca327", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-45-10-65281-35-16-0-11-13-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790320388, "last_seen": 1790320388, "transport": "t", "ja3_hash": "a3cebab136e5d8516d28c8ffc1c386d5", "ja3_variant_count": 1, "ja3_variants": [ "a3cebab136e5d8516d28c8ffc1c386d5" ], "user_agents": { "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 2 }, "ua_disagreement": false } }, { "hash": "t12d1510h2_8daaf6152771_5108843bd1cf", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1510h2", "b": "8daaf6152771", "c": "5108843bd1cf", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-0-35-17613-11-13-18-16-45-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788760445, "last_seen": 1788760445, "transport": "t", "ja3_hash": "b90f10a94af7bd4c342d7f013d8ad697", "ja3_variant_count": 1, "ja3_variants": [ "b90f10a94af7bd4c342d7f013d8ad697" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12d1510h2_8daaf6152771_64a2ba4fb516", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1510h2", "b": "8daaf6152771", "c": "64a2ba4fb516", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-11-5-45-65037-23-17613-0-35-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789140920, "last_seen": 1789140920, "transport": "t", "ja3_hash": "189870719493748f21a44367d6a0bcd2", "ja3_variant_count": 1, "ja3_variants": [ "189870719493748f21a44367d6a0bcd2" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 9 }, "ua_disagreement": false } }, { "hash": "t12d1510h2_8daaf6152771_73cf8644c0f2", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Opera \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1510h2", "b": "8daaf6152771", "c": "73cf8644c0f2", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-65037-5-11-0-17613-35-18-27-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791032356, "last_seen": 1791032356, "transport": "t", "ja3_hash": "4d08041e9c95fd11e1c49bb73d70a699", "ja3_variant_count": 1, "ja3_variants": [ "4d08041e9c95fd11e1c49bb73d70a699" ], "user_agents": { "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36 OPR/102.0.0.0": 11 }, "ua_disagreement": false } }, { "hash": "t12d1510h2_8daaf6152771_7456b419a5f8", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1510h2", "b": "8daaf6152771", "c": "7456b419a5f8", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-45-16-11-65037-5-18-0-65281-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788571296, "last_seen": 1788571296, "transport": "t", "ja3_hash": "64637610e5a4cc9c2fa5c87882762363", "ja3_variant_count": 1, "ja3_variants": [ "64637610e5a4cc9c2fa5c87882762363" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36 Edg/148.0.0.0": 1 }, "ua_disagreement": false } }, { "hash": "t12d1510h2_8daaf6152771_797a061ca5c5", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1510h2", "b": "8daaf6152771", "c": "797a061ca5c5", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-18-65281-11-17613-10-13-0-5-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788570644, "last_seen": 1788570644, "transport": "t", "ja3_hash": "a576fe7e2204d473da4d50dbfda048fd", "ja3_variant_count": 1, "ja3_variants": [ "a576fe7e2204d473da4d50dbfda048fd" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.132 Safari/537.36": 2 }, "ua_disagreement": false } }, { "hash": "t12d1510h2_8daaf6152771_7f5b27f10ff0", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1510h2", "b": "8daaf6152771", "c": "7f5b27f10ff0", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4866-4865-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-0-18-5-35-13-23-17613-65037-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789201593, "last_seen": 1789201593, "transport": "t", "ja3_hash": "a5d7c70872855627ca52feb1bc77e1c2", "ja3_variant_count": 1, "ja3_variants": [ "a5d7c70872855627ca52feb1bc77e1c2" ], "user_agents": { "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 17 }, "ua_disagreement": false } }, { "hash": "t12d1510h2_8daaf6152771_8011625d9f9c", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1510h2", "b": "8daaf6152771", "c": "8011625d9f9c", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-10-0-16-23-13-27-5-51764-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788443553, "last_seen": 1788443553, "transport": "t", "ja3_hash": "6caf367979e46e625439739de9820fd3", "ja3_variant_count": 1, "ja3_variants": [ "6caf367979e46e625439739de9820fd3" ], "user_agents": { "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d1510h2_8daaf6152771_81eafc1fb399", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1510h2", "b": "8daaf6152771", "c": "81eafc1fb399", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-16-65037-0-10-65281-23-27-18-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790777981, "last_seen": 1790777981, "transport": "t", "ja3_hash": "6ab50b2abb4a71d5ff3a0df1a3cbfd11", "ja3_variant_count": 1, "ja3_variants": [ "6ab50b2abb4a71d5ff3a0df1a3cbfd11" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d1510h2_8daaf6152771_9137260a110b", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1510h2", "b": "8daaf6152771", "c": "9137260a110b", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-16-23-65281-13-17613-0-45-5-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 0, "name": "server_name", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791241364, "last_seen": 1791241364, "transport": "t", "ja3_hash": "f1f82dba0196c21ab5274bde049b2581", "ja3_variant_count": 1, "ja3_variants": [ "f1f82dba0196c21ab5274bde049b2581" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d1510h2_8daaf6152771_926e44f04d6e", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1510h2", "b": "8daaf6152771", "c": "926e44f04d6e", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-17613-51764-5-23-65037-18-65281-16-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 5, "name": "status_request", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791155960, "last_seen": 1791155960, "transport": "t", "ja3_hash": "51091ff5142573857962308f42c30c26", "ja3_variant_count": 1, "ja3_variants": [ "51091ff5142573857962308f42c30c26" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36": 90 }, "ua_disagreement": false } }, { "hash": "t12d1510h2_8daaf6152771_9482cf1d5e45", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1510h2", "b": "8daaf6152771", "c": "9482cf1d5e45", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-65281-23-17513-27-0-45-18-16-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 17513, "name": "application_settings", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790500989, "last_seen": 1790500989, "transport": "t", "ja3_hash": "fe28dac17c3629da15bea282d1cf59cd", "ja3_variant_count": 1, "ja3_variants": [ "fe28dac17c3629da15bea282d1cf59cd" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d1510h2_8daaf6152771_98199706beb3", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1510h2", "b": "8daaf6152771", "c": "98199706beb3", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-65037-0-16-27-11-45-23-17613-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790243920, "last_seen": 1790243920, "transport": "t", "ja3_hash": "9f2da3b2c6ed7399dab40e30578e26b3", "ja3_variant_count": 1, "ja3_variants": [ "9f2da3b2c6ed7399dab40e30578e26b3" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d1510h2_8daaf6152771_9bd5dce74306", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1510h2", "b": "8daaf6152771", "c": "9bd5dce74306", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-23-16-10-65037-0-17613-27-5-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791279440, "last_seen": 1791279440, "transport": "t", "ja3_hash": "1ded339a88934decbf7856116b29ec03", "ja3_variant_count": 1, "ja3_variants": [ "1ded339a88934decbf7856116b29ec03" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 10 }, "ua_disagreement": false } }, { "hash": "t12d1510h2_8daaf6152771_a00146185b07", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1510h2", "b": "8daaf6152771", "c": "a00146185b07", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-16-23-5-10-17613-13-11-65281-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790465463, "last_seen": 1790465463, "transport": "t", "ja3_hash": "7c67317c1cef2baa324b4ac7a19deb4b", "ja3_variant_count": 1, "ja3_variants": [ "7c67317c1cef2baa324b4ac7a19deb4b" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36": 3 }, "ua_disagreement": false } }, { "hash": "t12d1510h2_8daaf6152771_aa6324e8e9b6", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1510h2", "b": "8daaf6152771", "c": "aa6324e8e9b6", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-27-35-10-65281-16-0-5-65037-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789028248, "last_seen": 1789028248, "transport": "t", "ja3_hash": "c9a03d8ef4dff3eedc561e033709633c", "ja3_variant_count": 1, "ja3_variants": [ "c9a03d8ef4dff3eedc561e033709633c" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12d1510h2_8daaf6152771_abcdc00e6c32", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Firefox \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1510h2", "b": "8daaf6152771", "c": "abcdc00e6c32", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4867-4866-49195-49199-52393-52392-49196-49200-49171-49172-156-157-47-53,0-23-65281-10-11-35-16-5-34-51,4588-29-23-24-25-256-257,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 34, "name": "34 (0x0022)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true }, { "value": 256, "name": "ffdhe2048", "known": true }, { "value": 257, "name": "ffdhe3072", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 4, "first_seen": 1789720074, "last_seen": 1789720074, "transport": "t", "ja3_hash": "924015c57f5a543584dd5f48decc7598", "ja3_variant_count": 1, "ja3_variants": [ "924015c57f5a543584dd5f48decc7598" ], "user_agents": { "Mozilla/5.0 (Android 15; Mobile; rv:154.0) Gecko/154.0 Firefox/154.0": 9 }, "ua_disagreement": false } }, { "hash": "t12d1510h2_8daaf6152771_b06e6b7a689c", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1510h2", "b": "8daaf6152771", "c": "b06e6b7a689c", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-17613-16-13-35-0-18-27-65037-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791110327, "last_seen": 1791110327, "transport": "t", "ja3_hash": "9c502c6520582ce83a65e4d68ff87835", "ja3_variant_count": 1, "ja3_variants": [ "9c502c6520582ce83a65e4d68ff87835" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 10 }, "ua_disagreement": false } }, { "hash": "t12d1510h2_8daaf6152771_b1732d34d86d", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1510h2", "b": "8daaf6152771", "c": "b1732d34d86d", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-23-27-5-65281-65037-16-10-11-51,29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791106247, "last_seen": 1791106247, "transport": "t", "ja3_hash": "e9ee0e4c305495cb626daa753d00508f", "ja3_variant_count": 1, "ja3_variants": [ "e9ee0e4c305495cb626daa753d00508f" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36 Edg/144.0.0.0": 1 }, "ua_disagreement": false } }, { "hash": "t12d1510h2_8daaf6152771_c14b00694c98", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1510h2", "b": "8daaf6152771", "c": "c14b00694c98", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-51-65037-11-35-27-13-23-16-17513,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 17513, "name": "application_settings", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791274375, "last_seen": 1791274375, "transport": "t", "ja3_hash": "279739b44e8a55e260ae37eb230fc4e6", "ja3_variant_count": 1, "ja3_variants": [ "279739b44e8a55e260ae37eb230fc4e6" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d1510h2_8daaf6152771_c15ac183f809", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1510h2", "b": "8daaf6152771", "c": "c15ac183f809", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-27-11-0-13-45-10-65037-5-35,29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 35, "name": "session_ticket", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791287240, "last_seen": 1791287240, "transport": "t", "ja3_hash": "8f7dab030498f922b09996ce90e70a20", "ja3_variant_count": 1, "ja3_variants": [ "8f7dab030498f922b09996ce90e70a20" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d1510h2_8daaf6152771_c56e0bf049c3", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Firefox \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1510h2", "b": "8daaf6152771", "c": "c56e0bf049c3", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4867-4866-49195-49199-52393-52392-49196-49200-49171-49172-156-157-47-53,0-23-65281-10-11-35-16-34-18-51,4588-29-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 34, "name": "34 (0x0022)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790637103, "last_seen": 1790637103, "transport": "t", "ja3_hash": "4ce706c1f228f4cbb4f89675e37784b0", "ja3_variant_count": 1, "ja3_variants": [ "4ce706c1f228f4cbb4f89675e37784b0" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:156.0) Gecko/20100101 Firefox/156.0": 31 }, "ua_disagreement": false } }, { "hash": "t12d1510h2_8daaf6152771_cbdbe390883f", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1510h2", "b": "8daaf6152771", "c": "cbdbe390883f", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-65281-65037-27-17613-13-16-0-10-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790946182, "last_seen": 1790946182, "transport": "t", "ja3_hash": "631fad633c84491197ac01642c9af948", "ja3_variant_count": 1, "ja3_variants": [ "631fad633c84491197ac01642c9af948" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.1.1 Safari/537.36 Edg/132.1.1": 1 }, "ua_disagreement": false } }, { "hash": "t12d1510h2_8daaf6152771_d36383becc34", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1510h2", "b": "8daaf6152771", "c": "d36383becc34", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-13-0-16-23-11-10-35-5-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790261146, "last_seen": 1790261146, "transport": "t", "ja3_hash": "32b25e84b3f7b3961f3446be190aa558", "ja3_variant_count": 1, "ja3_variants": [ "32b25e84b3f7b3961f3446be190aa558" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d1510h2_8daaf6152771_d72149cb519b", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1510h2", "b": "8daaf6152771", "c": "d72149cb519b", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-65037-17613-5-35-27-11-16-0-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 5, "name": "status_request", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789929602, "last_seen": 1789929602, "transport": "t", "ja3_hash": "5cec7bb013d8e85242ab18c89892d15c", "ja3_variant_count": 1, "ja3_variants": [ "5cec7bb013d8e85242ab18c89892d15c" ], "user_agents": { "Mozilla/5.0 (Linux; Android 14; Pixel 8 Pro) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Mobile Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d1510h2_8daaf6152771_d9616833dbf5", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1510h2", "b": "8daaf6152771", "c": "d9616833dbf5", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-10-0-16-23-65281-45-13-11-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790224284, "last_seen": 1790224284, "transport": "t", "ja3_hash": "afee49e801cb4d5cb508b880fc137d18", "ja3_variant_count": 1, "ja3_variants": [ "afee49e801cb4d5cb508b880fc137d18" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d1510h2_8daaf6152771_dcca4f652939", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1510h2", "b": "8daaf6152771", "c": "dcca4f652939", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-16-65281-10-65037-35-11-23-27-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790147158, "last_seen": 1790147158, "transport": "t", "ja3_hash": "92d8bbd522909b7cec18be84741f2d82", "ja3_variant_count": 1, "ja3_variants": [ "92d8bbd522909b7cec18be84741f2d82" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d1510h2_8daaf6152771_e2d59eefdd1d", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1510h2", "b": "8daaf6152771", "c": "e2d59eefdd1d", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-17513-65281-16-51-5-0-27-23-65037,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 17513, "name": "application_settings", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790941814, "last_seen": 1790941814, "transport": "t", "ja3_hash": "5e96e7c6e07c3c9a21279e6b1096e8fb", "ja3_variant_count": 1, "ja3_variants": [ "5e96e7c6e07c3c9a21279e6b1096e8fb" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d1510h2_8daaf6152771_e9131eb77c7c", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1510h2", "b": "8daaf6152771", "c": "e9131eb77c7c", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-65281-35-45-16-5-0-17613-23-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788992979, "last_seen": 1788992979, "transport": "t", "ja3_hash": "fc905ac276fe9651a1641759751da17b", "ja3_variant_count": 1, "ja3_variants": [ "fc905ac276fe9651a1641759751da17b" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12d1510h2_8daaf6152771_e9d93497cdbd", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1510h2", "b": "8daaf6152771", "c": "e9d93497cdbd", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-65281-65037-23-10-16-0-5-27-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790247319, "last_seen": 1790247319, "transport": "t", "ja3_hash": "b924849430d5170d102c0c2c68981635", "ja3_variant_count": 1, "ja3_variants": [ "b924849430d5170d102c0c2c68981635" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d1510h2_8daaf6152771_f2df6f11da9f", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1510h2", "b": "8daaf6152771", "c": "f2df6f11da9f", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-10-0-35-5-65037-16-45-13-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788932606, "last_seen": 1788932606, "transport": "t", "ja3_hash": "ecf5e1c262b98397f34779de5c938d2f", "ja3_variant_count": 1, "ja3_variants": [ "ecf5e1c262b98397f34779de5c938d2f" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 3 }, "ua_disagreement": false } }, { "hash": "t12d1510h2_8daaf6152771_f8735ac6b2e5", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1510h2", "b": "8daaf6152771", "c": "f8735ac6b2e5", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 10, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-17513-35-65037-0-13-16-65281-23-10,29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 17513, "name": "application_settings", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 10, "name": "supported_groups", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790941799, "last_seen": 1790941799, "transport": "t", "ja3_hash": "83e72d494db612a521378ddf6c39dcf6", "ja3_variant_count": 1, "ja3_variants": [ "83e72d494db612a521378ddf6c39dcf6" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d151100_8daaf6152771_05cb4f9724cf", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d151100", "b": "8daaf6152771", "c": "05cb4f9724cf", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-17613-11-65037-45-10-35-13-5-23-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790180774, "last_seen": 1790180774, "transport": "t", "ja3_hash": "b1de423eefbb5748421b1c1e2acdd294", "ja3_variant_count": 1, "ja3_variants": [ "b1de423eefbb5748421b1c1e2acdd294" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36 Edg/153.0.0.0": 91 }, "ua_disagreement": false } }, { "hash": "t12d151100_8daaf6152771_191ddca17219", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d151100", "b": "8daaf6152771", "c": "191ddca17219", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-65281-65037-18-35-13-45-27-5-0-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790859979, "last_seen": 1790859979, "transport": "t", "ja3_hash": "8094978bf7acaeec98f47397c0785880", "ja3_variant_count": 1, "ja3_variants": [ "8094978bf7acaeec98f47397c0785880" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36": 4 }, "ua_disagreement": false } }, { "hash": "t12d151100_8daaf6152771_19f0f7f2bc50", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d151100", "b": "8daaf6152771", "c": "19f0f7f2bc50", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-17613-45-13-11-23-5-0-10-65037-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790959671, "last_seen": 1790959671, "transport": "t", "ja3_hash": "5fe58862ba8bd9d33b15e654486010e7", "ja3_variant_count": 1, "ja3_variants": [ "5fe58862ba8bd9d33b15e654486010e7" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36 Edg/136.0.0.0": 1 }, "ua_disagreement": false } }, { "hash": "t12d151100_8daaf6152771_31ffca6a33c0", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d151100", "b": "8daaf6152771", "c": "31ffca6a33c0", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-10-5-65281-13-27-0-35-18-51764-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788450665, "last_seen": 1788450665, "transport": "t", "ja3_hash": "e5487b61ccea90af8d2fd1971ff0d313", "ja3_variant_count": 1, "ja3_variants": [ "e5487b61ccea90af8d2fd1971ff0d313" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 10 }, "ua_disagreement": false } }, { "hash": "t12d151100_8daaf6152771_39f6bd923d92", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d151100", "b": "8daaf6152771", "c": "39f6bd923d92", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-5-65037-17613-51764-65281-23-0-18-13-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788811250, "last_seen": 1788811250, "transport": "t", "ja3_hash": "cca1bbc7933075b90802e1246ffa19d4", "ja3_variant_count": 1, "ja3_variants": [ "cca1bbc7933075b90802e1246ffa19d4" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d151100_8daaf6152771_3a7e982837f5", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d151100", "b": "8daaf6152771", "c": "3a7e982837f5", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-11-35-45-13-18-17613-65281-65037-0-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790213009, "last_seen": 1790213009, "transport": "t", "ja3_hash": "b71072422959ae9cd0e77e0532769c50", "ja3_variant_count": 1, "ja3_variants": [ "b71072422959ae9cd0e77e0532769c50" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d151100_8daaf6152771_3a9380447b6e", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d151100", "b": "8daaf6152771", "c": "3a9380447b6e", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-45-13-17613-35-11-0-23-5-65281-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790236439, "last_seen": 1790236439, "transport": "t", "ja3_hash": "262412c5f9a26b5d137b8a76e6935838", "ja3_variant_count": 1, "ja3_variants": [ "262412c5f9a26b5d137b8a76e6935838" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d151100_8daaf6152771_405e8854d5f1", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d151100", "b": "8daaf6152771", "c": "405e8854d5f1", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-65281-45-13-65037-18-35-27-5-11-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789636884, "last_seen": 1789636884, "transport": "t", "ja3_hash": "f14d3d4ae5b2ecada0f5a9faaf7fa290", "ja3_variant_count": 1, "ja3_variants": [ "f14d3d4ae5b2ecada0f5a9faaf7fa290" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d151100_8daaf6152771_41f8fa758964", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d151100", "b": "8daaf6152771", "c": "41f8fa758964", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-0-17613-65281-35-5-11-65037-27-23-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789293524, "last_seen": 1789293524, "transport": "t", "ja3_hash": "c1772016b5be5b870d52d860038daf92", "ja3_variant_count": 1, "ja3_variants": [ "c1772016b5be5b870d52d860038daf92" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d151100_8daaf6152771_854f908dc172", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d151100", "b": "8daaf6152771", "c": "854f908dc172", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-0-11-18-5-65281-65037-13-23-17613-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790074347, "last_seen": 1790074347, "transport": "t", "ja3_hash": "73431375037e3a21e0baf7fa6291a22d", "ja3_variant_count": 1, "ja3_variants": [ "73431375037e3a21e0baf7fa6291a22d" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36 Edg/150.0.0.0": 26 }, "ua_disagreement": false } }, { "hash": "t12d151100_8daaf6152771_86bde990c4f7", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d151100", "b": "8daaf6152771", "c": "86bde990c4f7", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-10-13-65037-0-18-51-23-5-65281-16,29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791286043, "last_seen": 1791286043, "transport": "t", "ja3_hash": "a03fea8ce6eb82d6d58b4b943ecf74fa", "ja3_variant_count": 1, "ja3_variants": [ "a03fea8ce6eb82d6d58b4b943ecf74fa" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d151100_8daaf6152771_8e8443ba0bde", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d151100", "b": "8daaf6152771", "c": "8e8443ba0bde", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-0-27-17613-18-45-35-65037-10-23-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 2, "first_seen": 1789899235, "last_seen": 1791179599, "transport": "t", "ja3_hash": "b0f58cf66b6dc98720c52fdbe1514ffa", "ja3_variant_count": 2, "ja3_variants": [ "b0f58cf66b6dc98720c52fdbe1514ffa", "33606a2b1f0563ab8fd5dfaa5f87e266" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; https://zhanzhang.toutiao.com/)": 3 }, "ua_disagreement": false } }, { "hash": "t12d151100_8daaf6152771_979c64dbe299", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d151100", "b": "8daaf6152771", "c": "979c64dbe299", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-18-13-0-65037-65281-5-11-17613-35-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 2, "first_seen": 1788943217, "last_seen": 1790738628, "transport": "t", "ja3_hash": "d08428f25a8b38cf599764fde9a7dbd7", "ja3_variant_count": 2, "ja3_variants": [ "d08428f25a8b38cf599764fde9a7dbd7", "af1abd70f7af743602fcd7d2bb0f1534" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0 Safari/537.36 Edg/131.0.0": 2, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d151100_8daaf6152771_9cf718af64c5", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d151100", "b": "8daaf6152771", "c": "9cf718af64c5", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-0-27-11-45-17613-65281-65037-35-18-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788796556, "last_seen": 1788796556, "transport": "t", "ja3_hash": "2e1077a0db64355c3b7dc8383fd4eadb", "ja3_variant_count": 1, "ja3_variants": [ "2e1077a0db64355c3b7dc8383fd4eadb" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12d151100_8daaf6152771_a4f97efabfc2", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d151100", "b": "8daaf6152771", "c": "a4f97efabfc2", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-45-10-0-65281-27-13-18-11-17613-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790209121, "last_seen": 1790209121, "transport": "t", "ja3_hash": "622d04d2b577c61f0d9d72e945aa9aaf", "ja3_variant_count": 1, "ja3_variants": [ "622d04d2b577c61f0d9d72e945aa9aaf" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d151100_8daaf6152771_a57a75788fbf", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d151100", "b": "8daaf6152771", "c": "a57a75788fbf", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-27-51-65281-45-17613-0-5-35-18-16,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789142092, "last_seen": 1789142092, "transport": "t", "ja3_hash": "4d873fc8eafae312c2776863edc0a2e6", "ja3_variant_count": 1, "ja3_variants": [ "4d873fc8eafae312c2776863edc0a2e6" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 YaBrowser/26.8.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d151100_8daaf6152771_b59befcd7c9a", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d151100", "b": "8daaf6152771", "c": "b59befcd7c9a", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-35-10-18-11-27-0-17513-45-5-51,25497-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 17513, "name": "application_settings", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 25497, "name": "X25519Kyber768Draft00", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790086812, "last_seen": 1790086812, "transport": "t", "ja3_hash": "6a7b2697c2e12148e6e750db39dbacc8", "ja3_variant_count": 1, "ja3_variants": [ "6a7b2697c2e12148e6e750db39dbacc8" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d151100_8daaf6152771_b9078ebafdd8", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d151100", "b": "8daaf6152771", "c": "b9078ebafdd8", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-10-13-18-51764-17613-65281-45-0-35-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789669082, "last_seen": 1789669082, "transport": "t", "ja3_hash": "b15f7a2b0089827434da1e8264fac33b", "ja3_variant_count": 1, "ja3_variants": [ "b15f7a2b0089827434da1e8264fac33b" ], "user_agents": { "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36": 3 }, "ua_disagreement": false } }, { "hash": "t12d151100_8daaf6152771_cd08c7bd251b", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d151100", "b": "8daaf6152771", "c": "cd08c7bd251b", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-23-65037-11-5-18-0-27-35-45-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790740706, "last_seen": 1790740706, "transport": "t", "ja3_hash": "266af8928414c19206605c87ec73ec1a", "ja3_variant_count": 1, "ja3_variants": [ "266af8928414c19206605c87ec73ec1a" ], "user_agents": { "Mozilla/5.0 (Linux; Android 14; 23127PN0CC) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Mobile Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d151100_8daaf6152771_d24b5a63cb8d", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d151100", "b": "8daaf6152771", "c": "d24b5a63cb8d", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-27-0-13-23-65037-10-65281-11-18-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789446837, "last_seen": 1789446837, "transport": "t", "ja3_hash": "9bf466d5d3e30ba3ca09292e3bd555b3", "ja3_variant_count": 1, "ja3_variants": [ "9bf466d5d3e30ba3ca09292e3bd555b3" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d151100_8daaf6152771_d98d409acdf9", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d151100", "b": "8daaf6152771", "c": "d98d409acdf9", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-10-23-13-27-18-0-65037-65281-45-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790235718, "last_seen": 1790235718, "transport": "t", "ja3_hash": "25c0be37e77a3622c01c84130d4b888f", "ja3_variant_count": 1, "ja3_variants": [ "25c0be37e77a3622c01c84130d4b888f" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d151100_8daaf6152771_d99a7f6da5e1", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d151100", "b": "8daaf6152771", "c": "d99a7f6da5e1", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17513-65037-11-10-23-35-0-27-45-13-51,29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17513, "name": "application_settings", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791116696, "last_seen": 1791116696, "transport": "t", "ja3_hash": "e2976f052ccf54aac299c15c6b67163c", "ja3_variant_count": 1, "ja3_variants": [ "e2976f052ccf54aac299c15c6b67163c" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d151100_8daaf6152771_e86c81d884a7", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Firefox \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d151100", "b": "8daaf6152771", "c": "e86c81d884a7", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-35-23-17613-0-10-18-65281-13-5-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788979949, "last_seen": 1788979949, "transport": "t", "ja3_hash": "55260d9dc4c2db4f64d61c92580cee47", "ja3_variant_count": 1, "ja3_variants": [ "55260d9dc4c2db4f64d61c92580cee47" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:154.0) Gecko/20100101 Firefox/154.0": 1 }, "ua_disagreement": false } }, { "hash": "t12d1511h1_8daaf6152771_11d734e3a7ab", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1511h1", "b": "8daaf6152771", "c": "11d734e3a7ab", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": "h1" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-65281-18-11-13-10-0-5-65037-23-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790533350, "last_seen": 1790533350, "transport": "t", "ja3_hash": "0bfbfbddec121318dd6c498d7bb76073", "ja3_variant_count": 1, "ja3_variants": [ "0bfbfbddec121318dd6c498d7bb76073" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d1511h1_8daaf6152771_c4d416d83c1d", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1511h1", "b": "8daaf6152771", "c": "c4d416d83c1d", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": "h1" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-16-5-18-23-45-11-0-13-10-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790651132, "last_seen": 1790651132, "transport": "t", "ja3_hash": "df8cc7c0c4a35306820026c93b31bde4", "ja3_variant_count": 1, "ja3_variants": [ "df8cc7c0c4a35306820026c93b31bde4" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d1511h1_8daaf6152771_d5efd86df555", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1511h1", "b": "8daaf6152771", "c": "d5efd86df555", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": "h1" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-0-23-65281-10-16-11-27-13-45-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790528566, "last_seen": 1790528566, "transport": "t", "ja3_hash": "598c52dfac1ac278a693ebd338846e7a", "ja3_variant_count": 1, "ja3_variants": [ "598c52dfac1ac278a693ebd338846e7a" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d1511h1_8daaf6152771_df9ede0fdb17", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1511h1", "b": "8daaf6152771", "c": "df9ede0fdb17", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": "h1" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-65281-27-5-10-18-16-45-23-0-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790674070, "last_seen": 1790674070, "transport": "t", "ja3_hash": "398247047d5e211db6a2af527f04d88d", "ja3_variant_count": 1, "ja3_variants": [ "398247047d5e211db6a2af527f04d88d" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d1511h1_8daaf6152771_e43a71d47dc4", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1511h1", "b": "8daaf6152771", "c": "e43a71d47dc4", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": "h1" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-35-18-65281-23-0-16-65037-5-10-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790993701, "last_seen": 1790993701, "transport": "t", "ja3_hash": "32b72c6bfdb2ac55b06bbbf402047202", "ja3_variant_count": 1, "ja3_variants": [ "32b72c6bfdb2ac55b06bbbf402047202" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d1511h2_8daaf6152771_09c57bba7bb8", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Firefox \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1511h2", "b": "8daaf6152771", "c": "09c57bba7bb8", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4867-4866-49195-49199-52393-52392-49196-49200-49171-49172-156-157-47-53,0-23-65281-10-11-35-16-5-34-18-51,4588-29-23-24-25,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 34, "name": "34 (0x0022)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true }, { "value": 25, "name": "secp521r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 394, "first_seen": 1787485224, "last_seen": 1791303614, "transport": "t", "ja3_hash": "ca159e57d8ffb379a7d4548205fef76f", "ja3_variant_count": 4, "ja3_variants": [ "ca159e57d8ffb379a7d4548205fef76f", "e02c0f4e2781534ad53eed6393e007b2", "518c1854ccc5e24f40f10ce5417d83f4", "743918cb24139f810db9122dff27eb99" ], "user_agents": { "Mozilla/5.0 (X11; Linux x86_64; rv:154.0) Gecko/20100101 Firefox/154.0": 152, "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:155.0) Gecko/20100101 Firefox/155.0": 9, "Mozilla/5.0 (Android 14; Mobile; rv:156.0) Gecko/156.0 Firefox/156.0": 17, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:156.0) Gecko/20100101 Firefox/156.0": 317, "Mozilla/5.0 (Android 16; Mobile; rv:157.0) Gecko/157.0 Firefox/157.0": 27, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:154.0) Gecko/20100101 Firefox/154.0": 163, "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:154.0) Gecko/20100101 Firefox/154.0": 127, "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:154.0) Gecko/20100101 Firefox/154.0": 8, "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:156.0) Gecko/20100101 Firefox/156.0": 112 }, "ua_disagreement": false } }, { "hash": "t12d1511h2_8daaf6152771_0e9ead26a729", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1511h2", "b": "8daaf6152771", "c": "0e9ead26a729", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-17613-16-0-51764-35-11-10-13-65037-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791050025, "last_seen": 1791050025, "transport": "t", "ja3_hash": "c7e756094e094af7a872b984c7957ffc", "ja3_variant_count": 1, "ja3_variants": [ "c7e756094e094af7a872b984c7957ffc" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36": 10 }, "ua_disagreement": false } }, { "hash": "t12d1511h2_8daaf6152771_12ac04d72c83", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1511h2", "b": "8daaf6152771", "c": "12ac04d72c83", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-65281-16-45-65037-13-11-35-0-10-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788657952, "last_seen": 1788657952, "transport": "t", "ja3_hash": "3aa2a868558f9199d75b6c92e0b8c50c", "ja3_variant_count": 1, "ja3_variants": [ "3aa2a868558f9199d75b6c92e0b8c50c" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 Edg/152.0.0.0": 15 }, "ua_disagreement": false } }, { "hash": "t12d1511h2_8daaf6152771_13deffa46569", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1511h2", "b": "8daaf6152771", "c": "13deffa46569", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-16-18-13-27-35-0-45-51764-65281-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790615345, "last_seen": 1790615345, "transport": "t", "ja3_hash": "378a11b1af03d5aa34c2c45ccff7ed34", "ja3_variant_count": 1, "ja3_variants": [ "378a11b1af03d5aa34c2c45ccff7ed34" ], "user_agents": { "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 4 }, "ua_disagreement": false } }, { "hash": "t12d1511h2_8daaf6152771_16129b27e950", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1511h2", "b": "8daaf6152771", "c": "16129b27e950", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-0-13-17613-10-27-65037-16-45-23-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789688313, "last_seen": 1789688313, "transport": "t", "ja3_hash": "4343e82c071f76e10b9484e6bfd4cb03", "ja3_variant_count": 1, "ja3_variants": [ "4343e82c071f76e10b9484e6bfd4cb03" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12d1511h2_8daaf6152771_162677efcc06", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1511h2", "b": "8daaf6152771", "c": "162677efcc06", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-16-11-0-5-27-10-18-17613-65281-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790582349, "last_seen": 1790582349, "transport": "t", "ja3_hash": "0732966b925c2d624b2ea172af78ef37", "ja3_variant_count": 1, "ja3_variants": [ "0732966b925c2d624b2ea172af78ef37" ], "user_agents": { "Mozilla/5.0 (Linux; Android 14; 23127PN0CC) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Mobile Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d1511h2_8daaf6152771_235ac8537342", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1511h2", "b": "8daaf6152771", "c": "235ac8537342", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-0-35-23-27-5-16-65037-45-18-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791155523, "last_seen": 1791155523, "transport": "t", "ja3_hash": "102ecfcf1708674ccb25725d603af6ac", "ja3_variant_count": 1, "ja3_variants": [ "102ecfcf1708674ccb25725d603af6ac" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36 Edg/153.0.0.0": 40 }, "ua_disagreement": false } }, { "hash": "t12d1511h2_8daaf6152771_265bfdc87561", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1511h2", "b": "8daaf6152771", "c": "265bfdc87561", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-16-23-11-35-17613-5-65281-18-27-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 5, "name": "status_request", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 2, "first_seen": 1790118097, "last_seen": 1790261145, "transport": "t", "ja3_hash": "f0783dde12b454458c9b186aeb9d27ce", "ja3_variant_count": 2, "ja3_variants": [ "f0783dde12b454458c9b186aeb9d27ce", "e711096b4080dbc562249af4b6815efa" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/146.0.7680.165 Safari/537.36": 1 }, "ua_disagreement": true } }, { "hash": "t12d1511h2_8daaf6152771_324c097558a0", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1511h2", "b": "8daaf6152771", "c": "324c097558a0", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-35-16-18-65037-45-27-13-11-0-43,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 43, "name": "supported_versions", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791296378, "last_seen": 1791296378, "transport": "t", "ja3_hash": "62b74c58f1082cd193d449f3c9d23f44", "ja3_variant_count": 1, "ja3_variants": [ "62b74c58f1082cd193d449f3c9d23f44" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d1511h2_8daaf6152771_3569fb37f72a", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1511h2", "b": "8daaf6152771", "c": "3569fb37f72a", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-16-10-35-45-65037-11-0-5-17613-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788451781, "last_seen": 1788451781, "transport": "t", "ja3_hash": "9f4796e185998c3cf85e9fbcb5af101d", "ja3_variant_count": 1, "ja3_variants": [ "9f4796e185998c3cf85e9fbcb5af101d" ], "user_agents": { "Mozilla/5.0 (iPhone; CPU iPhone OS 18_3 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/148.0.0.0 Mobile/15E148 Safari/604.1": 1 }, "ua_disagreement": false } }, { "hash": "t12d1511h2_8daaf6152771_35c15a818768", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1511h2", "b": "8daaf6152771", "c": "35c15a818768", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-5-0-27-18-45-23-35-65281-16-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788680450, "last_seen": 1788680450, "transport": "t", "ja3_hash": "87987487f96a5edd615aea5b225af664", "ja3_variant_count": 1, "ja3_variants": [ "87987487f96a5edd615aea5b225af664" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12d1511h2_8daaf6152771_35fc7e1c74ec", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1511h2", "b": "8daaf6152771", "c": "35fc7e1c74ec", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-16-0-35-23-45-18-65281-13-5-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790453149, "last_seen": 1790453149, "transport": "t", "ja3_hash": "e388bf2dd104a674bd3dde58b46cece9", "ja3_variant_count": 1, "ja3_variants": [ "e388bf2dd104a674bd3dde58b46cece9" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d1511h2_8daaf6152771_470722fd683a", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1511h2", "b": "8daaf6152771", "c": "470722fd683a", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-18-35-13-45-0-65281-27-17613-65037-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790186667, "last_seen": 1790186667, "transport": "t", "ja3_hash": "ee5e42d5a12ac76e6d59b2e5e91b1c4d", "ja3_variant_count": 1, "ja3_variants": [ "ee5e42d5a12ac76e6d59b2e5e91b1c4d" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d1511h2_8daaf6152771_511e060441ec", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1511h2", "b": "8daaf6152771", "c": "511e060441ec", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-23-5-27-11-45-0-65281-65037-16-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791106735, "last_seen": 1791106735, "transport": "t", "ja3_hash": "d62e1b849dbbea4ff9234be5daa573c4", "ja3_variant_count": 1, "ja3_variants": [ "d62e1b849dbbea4ff9234be5daa573c4" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36 Edg/144.0.0.0": 1 }, "ua_disagreement": false } }, { "hash": "t12d1511h2_8daaf6152771_54b09dcce25c", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1511h2", "b": "8daaf6152771", "c": "54b09dcce25c", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-10-5-0-17613-23-16-27-11-45-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790075622, "last_seen": 1790075622, "transport": "t", "ja3_hash": "422ff08e22869a5a148603ce0eb00eed", "ja3_variant_count": 1, "ja3_variants": [ "422ff08e22869a5a148603ce0eb00eed" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36 Edg/153.0.0.0": 14 }, "ua_disagreement": false } }, { "hash": "t12d1511h2_8daaf6152771_558b9a9a2ecc", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1511h2", "b": "8daaf6152771", "c": "558b9a9a2ecc", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-13-16-45-0-51764-27-65037-35-17613-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791109999, "last_seen": 1791109999, "transport": "t", "ja3_hash": "88bf5896c60ecd9d15091646e11df608", "ja3_variant_count": 1, "ja3_variants": [ "88bf5896c60ecd9d15091646e11df608" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36": 9 }, "ua_disagreement": false } }, { "hash": "t12d1511h2_8daaf6152771_5c005630fa0d", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1511h2", "b": "8daaf6152771", "c": "5c005630fa0d", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51-17513-0-11-65281-16-65037-45-27-10-23,29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51, "name": "key_share", "known": true }, { "value": 17513, "name": "application_settings", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791102868, "last_seen": 1791102868, "transport": "t", "ja3_hash": "a9600904f1bc7053a72f137671f28d4e", "ja3_variant_count": 1, "ja3_variants": [ "a9600904f1bc7053a72f137671f28d4e" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d1511h2_8daaf6152771_68a830f9f41b", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1511h2", "b": "8daaf6152771", "c": "68a830f9f41b", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-23-65037-27-16-10-18-11-0-13-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789689534, "last_seen": 1789689534, "transport": "t", "ja3_hash": "ddcbcfaa589daa7b9b78b6afe0edee87", "ja3_variant_count": 1, "ja3_variants": [ "ddcbcfaa589daa7b9b78b6afe0edee87" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12d1511h2_8daaf6152771_8233bdbe604a", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1511h2", "b": "8daaf6152771", "c": "8233bdbe604a", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-16-65037-65281-27-0-23-45-35-18-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789681485, "last_seen": 1789681485, "transport": "t", "ja3_hash": "496f3ebd14e0e73edd17ba8ec39258d1", "ja3_variant_count": 1, "ja3_variants": [ "496f3ebd14e0e73edd17ba8ec39258d1" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12d1511h2_8daaf6152771_86a73e648689", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1511h2", "b": "8daaf6152771", "c": "86a73e648689", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-23-13-0-27-18-65281-11-65037-5-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788798453, "last_seen": 1788798453, "transport": "t", "ja3_hash": "1d4f9bcc3aa36a82227faf332d1d6279", "ja3_variant_count": 1, "ja3_variants": [ "1d4f9bcc3aa36a82227faf332d1d6279" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12d1511h2_8daaf6152771_8a4f5bed057f", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1511h2", "b": "8daaf6152771", "c": "8a4f5bed057f", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-27-5-16-65037-13-45-10-35-23-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788572615, "last_seen": 1788572615, "transport": "t", "ja3_hash": "7b782fcebd3eb8ca1f63ced973ff1b39", "ja3_variant_count": 1, "ja3_variants": [ "7b782fcebd3eb8ca1f63ced973ff1b39" ], "user_agents": { "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Mobile Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d1511h2_8daaf6152771_8dc198b1a74d", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1511h2", "b": "8daaf6152771", "c": "8dc198b1a74d", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-13-45-16-65281-5-10-0-11-23-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790239104, "last_seen": 1790239104, "transport": "t", "ja3_hash": "5439bf30be1ef803442fc4e88705361c", "ja3_variant_count": 1, "ja3_variants": [ "5439bf30be1ef803442fc4e88705361c" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d1511h2_8daaf6152771_8efff3639520", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1511h2", "b": "8daaf6152771", "c": "8efff3639520", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-16-13-65037-45-27-0-5-35-11-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790228932, "last_seen": 1790228932, "transport": "t", "ja3_hash": "c016d88d8df09744e90c4f5d6f93d57e", "ja3_variant_count": 1, "ja3_variants": [ "c016d88d8df09744e90c4f5d6f93d57e" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d1511h2_8daaf6152771_93837386752e", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1511h2", "b": "8daaf6152771", "c": "93837386752e", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-27-17513-5-11-65281-0-10-16-51-65037,29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 17513, "name": "application_settings", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791258937, "last_seen": 1791258937, "transport": "t", "ja3_hash": "824060ab9cacffa7f381b6852221f051", "ja3_variant_count": 1, "ja3_variants": [ "824060ab9cacffa7f381b6852221f051" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36 Edg/144.0.0.0": 1 }, "ua_disagreement": false } }, { "hash": "t12d1511h2_8daaf6152771_939b2ea05aa9", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1511h2", "b": "8daaf6152771", "c": "939b2ea05aa9", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-17613-45-65281-10-65037-18-16-0-11-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790216796, "last_seen": 1790216796, "transport": "t", "ja3_hash": "18b560374cd8dbb667068d0e480f6e0e", "ja3_variant_count": 1, "ja3_variants": [ "18b560374cd8dbb667068d0e480f6e0e" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d1511h2_8daaf6152771_a7132ca8cc4d", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1511h2", "b": "8daaf6152771", "c": "a7132ca8cc4d", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-5-65037-16-0-45-18-17513-35-13-10,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 17513, "name": "application_settings", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 10, "name": "supported_groups", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791289484, "last_seen": 1791289484, "transport": "t", "ja3_hash": "484d28b8261730cd34c1b544cb46b8d4", "ja3_variant_count": 1, "ja3_variants": [ "484d28b8261730cd34c1b544cb46b8d4" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36 Edg/144.0.0.0": 1 }, "ua_disagreement": false } }, { "hash": "t12d1511h2_8daaf6152771_a8ec87a1d80b", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1511h2", "b": "8daaf6152771", "c": "a8ec87a1d80b", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-16-0-45-13-51764-35-5-27-23-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790795896, "last_seen": 1790795896, "transport": "t", "ja3_hash": "a60abf7c1c30a2f12faad952ea4be420", "ja3_variant_count": 1, "ja3_variants": [ "a60abf7c1c30a2f12faad952ea4be420" ], "user_agents": { "Mozilla/5.0 (iPhone; CPU iPhone OS 15_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/26.5 Mobile/15E148 Safari/604.1": 5 }, "ua_disagreement": false } }, { "hash": "t12d1511h2_8daaf6152771_aba74868c18f", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1511h2", "b": "8daaf6152771", "c": "aba74868c18f", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,17613-18-5-23-10-11-65037-16-0-35-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791166831, "last_seen": 1791166831, "transport": "t", "ja3_hash": "2d00d2353f37c48a4e69905411654aff", "ja3_variant_count": 1, "ja3_variants": [ "2d00d2353f37c48a4e69905411654aff" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 10 }, "ua_disagreement": false } }, { "hash": "t12d1511h2_8daaf6152771_ac302f8c9f72", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1511h2", "b": "8daaf6152771", "c": "ac302f8c9f72", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-35-65281-45-0-5-16-65037-13-27-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 2, "first_seen": 1790480454, "last_seen": 1790608583, "transport": "t", "ja3_hash": "282bb8e9f9aa83668c62b3ab4d37212c", "ja3_variant_count": 2, "ja3_variants": [ "282bb8e9f9aa83668c62b3ab4d37212c", "9de5203da61bb9f072429158350acf41" ], "user_agents": { "Mozilla/5.0 (iPhone; CPU iPhone OS 18_4 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/151.0.0.0 Mobile/15E148 Safari/604.1": 1, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d1511h2_8daaf6152771_b6f234c0c961", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1511h2", "b": "8daaf6152771", "c": "b6f234c0c961", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-0-16-10-13-45-65037-35-18-65281-27,29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 27, "name": "compress_certificate", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791290762, "last_seen": 1791290762, "transport": "t", "ja3_hash": "a57d187985cb48f65b51f1c0a8a69c95", "ja3_variant_count": 1, "ja3_variants": [ "a57d187985cb48f65b51f1c0a8a69c95" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0": 1 }, "ua_disagreement": false } }, { "hash": "t12d1511h2_8daaf6152771_be8a13a88d86", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1511h2", "b": "8daaf6152771", "c": "be8a13a88d86", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-5-65037-27-23-18-35-13-16-17613-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791110205, "last_seen": 1791110205, "transport": "t", "ja3_hash": "846067c9d61adcafc464fd94c9d65a94", "ja3_variant_count": 1, "ja3_variants": [ "846067c9d61adcafc464fd94c9d65a94" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 10 }, "ua_disagreement": false } }, { "hash": "t12d1511h2_8daaf6152771_c4142f071ad7", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1511h2", "b": "8daaf6152771", "c": "c4142f071ad7", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,51764-16-0-23-35-18-17613-27-13-65281-51,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789988380, "last_seen": 1789988380, "transport": "t", "ja3_hash": "6cccba5f8026340a80c969ca0c859d71", "ja3_variant_count": 1, "ja3_variants": [ "6cccba5f8026340a80c969ca0c859d71" ], "user_agents": { "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36": 16 }, "ua_disagreement": false } }, { "hash": "t12d1511h2_8daaf6152771_c6297bb175f0", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1511h2", "b": "8daaf6152771", "c": "c6297bb175f0", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-0-16-65037-13-35-18-11-23-17613-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790209254, "last_seen": 1790209254, "transport": "t", "ja3_hash": "09c65fb62b02736735eddee3716f7ad0", "ja3_variant_count": 1, "ja3_variants": [ "09c65fb62b02736735eddee3716f7ad0" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d1511h2_8daaf6152771_c6990e83e2e0", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1511h2", "b": "8daaf6152771", "c": "c6990e83e2e0", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-11-35-23-16-0-65281-18-13-17613-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791134317, "last_seen": 1791134317, "transport": "t", "ja3_hash": "ba57c2d32cebcb4236455ff551c3f4c2", "ja3_variant_count": 1, "ja3_variants": [ "ba57c2d32cebcb4236455ff551c3f4c2" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d1511h2_8daaf6152771_d2d31525478d", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Edge \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1511h2", "b": "8daaf6152771", "c": "d2d31525478d", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-27-5-17613-13-35-16-45-65281-11-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790055593, "last_seen": 1790055593, "transport": "t", "ja3_hash": "d50a8eb7bc4e7d70957b1ac8c11c7cc3", "ja3_variant_count": 1, "ja3_variants": [ "d50a8eb7bc4e7d70957b1ac8c11c7cc3" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36 Edg/135.0.0.0": 9 }, "ua_disagreement": false } }, { "hash": "t12d1511h2_8daaf6152771_d3db1c9b03b8", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1511h2", "b": "8daaf6152771", "c": "d3db1c9b03b8", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-0-10-5-13-65281-35-11-27-51764-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788647898, "last_seen": 1788647898, "transport": "t", "ja3_hash": "38a1e71d2d07246b7a0b5ff9d6a2ff45", "ja3_variant_count": 1, "ja3_variants": [ "38a1e71d2d07246b7a0b5ff9d6a2ff45" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36": 6 }, "ua_disagreement": false } }, { "hash": "t12d1511h2_8daaf6152771_d851df99f70b", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1511h2", "b": "8daaf6152771", "c": "d851df99f70b", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-18-35-10-45-16-13-0-17613-65281-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1789006499, "last_seen": 1789006499, "transport": "t", "ja3_hash": "dde6dbdfca0cf07bfeb3a65db4815aa8", "ja3_variant_count": 1, "ja3_variants": [ "dde6dbdfca0cf07bfeb3a65db4815aa8" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12d1511h2_8daaf6152771_e121f1e68165", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1511h2", "b": "8daaf6152771", "c": "e121f1e68165", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-13-16-23-45-17613-27-0-11-65281-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791216644, "last_seen": 1791216644, "transport": "t", "ja3_hash": "35f78a3441d31397ec496a7736b750a8", "ja3_variant_count": 1, "ja3_variants": [ "35f78a3441d31397ec496a7736b750a8" ], "user_agents": { "Mozilla/5.0 (Linux; Android 15; CPH2653) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Mobile Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d1511h2_8daaf6152771_e8e54ed94573", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1511h2", "b": "8daaf6152771", "c": "e8e54ed94573", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-0-27-11-10-23-16-45-18-17613-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790736635, "last_seen": 1790736635, "transport": "t", "ja3_hash": "8c626c4268b1816a452ffeda48fc73af", "ja3_variant_count": 1, "ja3_variants": [ "8c626c4268b1816a452ffeda48fc73af" ], "user_agents": { "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36": 4 }, "ua_disagreement": false } }, { "hash": "t12d1511h2_8daaf6152771_f0228183adfd", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1511h2", "b": "8daaf6152771", "c": "f0228183adfd", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-13-65281-17613-11-65037-0-27-10-5-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788709915, "last_seen": 1788709915, "transport": "t", "ja3_hash": "4fd786c3f494c4427f2391740f48a54c", "ja3_variant_count": 1, "ja3_variants": [ "4fd786c3f494c4427f2391740f48a54c" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12d1511h2_8daaf6152771_f9695dddbd85", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1511h2", "b": "8daaf6152771", "c": "f9695dddbd85", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-65281-13-35-23-17613-0-27-18-11-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 0, "name": "server_name", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790258691, "last_seen": 1790258691, "transport": "t", "ja3_hash": "b77342d0489c05e8ee571dd8f0ad3416", "ja3_variant_count": 1, "ja3_variants": [ "b77342d0489c05e8ee571dd8f0ad3416" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d1511h2_8daaf6152771_fb10956eb48b", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1511h2", "b": "8daaf6152771", "c": "fb10956eb48b", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 11, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-17513-23-45-11-16-65037-5-0-18-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 17513, "name": "application_settings", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790863494, "last_seen": 1790863494, "transport": "t", "ja3_hash": "8ae3ca019287873b6ab70343eefbcebf", "ja3_variant_count": 1, "ja3_variants": [ "8ae3ca019287873b6ab70343eefbcebf" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36": 2 }, "ua_disagreement": false } }, { "hash": "t12d151200_8daaf6152771_0488cee77a13", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d151200", "b": "8daaf6152771", "c": "0488cee77a13", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-18-11-10-65037-5-27-17513-13-0-23-16,29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 17513, "name": "application_settings", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791142432, "last_seen": 1791142432, "transport": "t", "ja3_hash": "e073bd36b42a3c5fefde58233603b37a", "ja3_variant_count": 1, "ja3_variants": [ "e073bd36b42a3c5fefde58233603b37a" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d151200_8daaf6152771_108fff90ab23", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d151200", "b": "8daaf6152771", "c": "108fff90ab23", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-65037-35-0-11-10-13-5-45-65281-23-51,25497-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 25497, "name": "X25519Kyber768Draft00", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1789635282, "last_seen": 1789635282, "transport": "t", "ja3_hash": "77fca4004f1df0395154da1896e4b44b", "ja3_variant_count": 1, "ja3_variants": [ "77fca4004f1df0395154da1896e4b44b" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d151200_8daaf6152771_13aa4f51f71d", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d151200", "b": "8daaf6152771", "c": "13aa4f51f71d", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-0-10-17613-5-35-11-27-45-23-18-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 5, "name": "status_request", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790216306, "last_seen": 1790216306, "transport": "t", "ja3_hash": "25762dde8cff6dcb80a307c4b25a58ed", "ja3_variant_count": 1, "ja3_variants": [ "25762dde8cff6dcb80a307c4b25a58ed" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d151200_8daaf6152771_1ffeb9beebad", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d151200", "b": "8daaf6152771", "c": "1ffeb9beebad", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-65037-23-35-27-45-5-10-18-17613-0-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788691341, "last_seen": 1788691341, "transport": "t", "ja3_hash": "147dc184688304c23c6f1373a2bd1b6b", "ja3_variant_count": 1, "ja3_variants": [ "147dc184688304c23c6f1373a2bd1b6b" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12d151200_8daaf6152771_2164bb0c937c", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d151200", "b": "8daaf6152771", "c": "2164bb0c937c", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65037-5-11-35-13-0-10-65281-45-27-18-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790234294, "last_seen": 1790234294, "transport": "t", "ja3_hash": "c892da905e16236f60abd3adff4021e2", "ja3_variant_count": 1, "ja3_variants": [ "c892da905e16236f60abd3adff4021e2" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36": 4 }, "ua_disagreement": false } }, { "hash": "t12d151200_8daaf6152771_29db12fd3636", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d151200", "b": "8daaf6152771", "c": "29db12fd3636", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-23-65281-5-45-11-17613-10-18-0-13-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788851356, "last_seen": 1788851356, "transport": "t", "ja3_hash": "7fb8c1c3b539a8ef4762a455868fabc5", "ja3_variant_count": 1, "ja3_variants": [ "7fb8c1c3b539a8ef4762a455868fabc5" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12d151200_8daaf6152771_351276e8394c", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d151200", "b": "8daaf6152771", "c": "351276e8394c", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-27-18-11-23-45-65037-13-0-65281-17613-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790192978, "last_seen": 1790192978, "transport": "t", "ja3_hash": "8e31c19c3a3815251043b7bc7b0cbe58", "ja3_variant_count": 1, "ja3_variants": [ "8e31c19c3a3815251043b7bc7b0cbe58" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d151200_8daaf6152771_5dc1fa1c868b", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d151200", "b": "8daaf6152771", "c": "5dc1fa1c868b", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-35-10-45-65037-23-18-0-13-11-27-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788722803, "last_seen": 1788722803, "transport": "t", "ja3_hash": "653cdda61ca2ff6dae40ee06e9c8c60b", "ja3_variant_count": 1, "ja3_variants": [ "653cdda61ca2ff6dae40ee06e9c8c60b" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d151200_8daaf6152771_8c706ac26d77", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d151200", "b": "8daaf6152771", "c": "8c706ac26d77", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-10-0-35-5-27-45-11-51-65281-18-65037,29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791137532, "last_seen": 1791137532, "transport": "t", "ja3_hash": "90e1916c76b572527178ea7dbf4f15b8", "ja3_variant_count": 1, "ja3_variants": [ "90e1916c76b572527178ea7dbf4f15b8" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d151200_8daaf6152771_91e0f9dc7df0", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d151200", "b": "8daaf6152771", "c": "91e0f9dc7df0", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-27-0-17613-65281-65037-45-10-5-11-13-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 2, "first_seen": 1790182746, "last_seen": 1790241673, "transport": "t", "ja3_hash": "546048a7d21d078351b331fa924d617a", "ja3_variant_count": 2, "ja3_variants": [ "546048a7d21d078351b331fa924d617a", "36b597e90d779b6068655adbe171cf1a" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 2 }, "ua_disagreement": false } }, { "hash": "t12d151200_8daaf6152771_dace3972a0fd", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d151200", "b": "8daaf6152771", "c": "dace3972a0fd", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,18-13-17613-5-65281-65037-0-10-45-27-23-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 5, "name": "status_request", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1790217856, "last_seen": 1790217856, "transport": "t", "ja3_hash": "67d86469a25458c0597b35e0693a7947", "ja3_variant_count": 1, "ja3_variants": [ "67d86469a25458c0597b35e0693a7947" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d151200_8daaf6152771_dea9b2028811", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d151200", "b": "8daaf6152771", "c": "dea9b2028811", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": null } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-11-23-45-0-65281-17613-10-13-5-35-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788787208, "last_seen": 1788787208, "transport": "t", "ja3_hash": "ab472e71e6578fc3d9d113b0c6418211", "ja3_variant_count": 1, "ja3_variants": [ "ab472e71e6578fc3d9d113b0c6418211" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12d1512h1_8daaf6152771_345ea8e0bb04", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1512h1", "b": "8daaf6152771", "c": "345ea8e0bb04", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": "h1" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-13-65037-18-45-10-16-5-65281-23-0-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790666962, "last_seen": 1790666962, "transport": "t", "ja3_hash": "c487ca72421782daf2d9e26a39d6245a", "ja3_variant_count": 1, "ja3_variants": [ "c487ca72421782daf2d9e26a39d6245a" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d1512h1_8daaf6152771_810248c73c4b", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1512h1", "b": "8daaf6152771", "c": "810248c73c4b", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": "h1" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-35-27-0-18-11-16-65037-10-13-5-51,25497-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 25497, "name": "X25519Kyber768Draft00", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790548560, "last_seen": 1790548560, "transport": "t", "ja3_hash": "4a63f0a1511c7c1a1db770a18e195396", "ja3_variant_count": 1, "ja3_variants": [ "4a63f0a1511c7c1a1db770a18e195396" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d1512h2_8daaf6152771_064b7b824fb2", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1512h2", "b": "8daaf6152771", "c": "064b7b824fb2", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-17613-0-27-10-13-35-16-45-11-65037-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 5, "name": "status_request", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 0, "name": "server_name", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790230036, "last_seen": 1790230036, "transport": "t", "ja3_hash": "97f935d091a27a98474e9a4a803d41b1", "ja3_variant_count": 1, "ja3_variants": [ "97f935d091a27a98474e9a4a803d41b1" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d1512h2_8daaf6152771_0f45a0a4b30d", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1512h2", "b": "8daaf6152771", "c": "0f45a0a4b30d", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-27-51764-17613-65281-18-10-13-0-65037-35-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791301502, "last_seen": 1791301502, "transport": "t", "ja3_hash": "08f24f979585fd4d00981eeed559697a", "ja3_variant_count": 1, "ja3_variants": [ "08f24f979585fd4d00981eeed559697a" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36": 6 }, "ua_disagreement": false } }, { "hash": "t12d1512h2_8daaf6152771_1956fb743284", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1512h2", "b": "8daaf6152771", "c": "1956fb743284", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-23-0-16-11-35-18-27-13-65281-65037-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1788528945, "last_seen": 1788528945, "transport": "t", "ja3_hash": "00a58d89d0da798bce63e9eb966812ec", "ja3_variant_count": 1, "ja3_variants": [ "00a58d89d0da798bce63e9eb966812ec" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d1512h2_8daaf6152771_199d98487440", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1512h2", "b": "8daaf6152771", "c": "199d98487440", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-23-17513-45-18-16-0-27-51-65281-13-65037,,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 35, "name": "session_ticket", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 17513, "name": "application_settings", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791151094, "last_seen": 1791151094, "transport": "t", "ja3_hash": "0c39d96a672fb558bd354cda24a1e64a", "ja3_variant_count": 1, "ja3_variants": [ "0c39d96a672fb558bd354cda24a1e64a" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d1512h2_8daaf6152771_1bd83aa9b395", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1512h2", "b": "8daaf6152771", "c": "1bd83aa9b395", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-23-11-17613-0-35-45-5-16-10-18-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 0, "name": "server_name", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790651504, "last_seen": 1790651504, "transport": "t", "ja3_hash": "e3aab7ae9122bbc6b4292fbbb2df8eec", "ja3_variant_count": 1, "ja3_variants": [ "e3aab7ae9122bbc6b4292fbbb2df8eec" ], "user_agents": { "Mozilla/5.0 (Linux; Android 10; K; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/154.0.0.0 Mobile Safari/537.36": 2, "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Mobile Safari/537.36": 31 }, "ua_disagreement": false } }, { "hash": "t12d1512h2_8daaf6152771_1e1bbaeae747", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1512h2", "b": "8daaf6152771", "c": "1e1bbaeae747", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-16-45-27-11-18-23-65281-13-65037-5-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791259895, "last_seen": 1791259895, "transport": "t", "ja3_hash": "9bfd0e7e5506aa104e4a69ed37cfab7d", "ja3_variant_count": 1, "ja3_variants": [ "9bfd0e7e5506aa104e4a69ed37cfab7d" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d1512h2_8daaf6152771_201ebf1a9a21", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1512h2", "b": "8daaf6152771", "c": "201ebf1a9a21", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,65281-13-16-23-18-35-0-5-45-10-27-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1788821028, "last_seen": 1788821028, "transport": "t", "ja3_hash": "967386ff0944b010a4ccd3fd0d4546fc", "ja3_variant_count": 1, "ja3_variants": [ "967386ff0944b010a4ccd3fd0d4546fc" ], "user_agents": { "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; TikTokSpider; ttspider-feedback@tiktok.com)": 1 }, "ua_disagreement": false } }, { "hash": "t12d1512h2_8daaf6152771_29a63ca31164", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1512h2", "b": "8daaf6152771", "c": "29a63ca31164", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-16-17613-27-35-45-11-65037-65281-13-23-51,,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790250143, "last_seen": 1790250143, "transport": "t", "ja3_hash": "472c18910b1591ebe200fb037814e96c", "ja3_variant_count": 1, "ja3_variants": [ "472c18910b1591ebe200fb037814e96c" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d1512h2_8daaf6152771_306b586bbdfa", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1512h2", "b": "8daaf6152771", "c": "306b586bbdfa", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,27-0-23-10-65281-11-65037-17613-18-16-13-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 27, "name": "compress_certificate", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790602191, "last_seen": 1790602191, "transport": "t", "ja3_hash": "5900dbce700037cf957fb714e9082106", "ja3_variant_count": 1, "ja3_variants": [ "5900dbce700037cf957fb714e9082106" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d1512h2_8daaf6152771_314eff97a049", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1512h2", "b": "8daaf6152771", "c": "314eff97a049", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-18-17513-35-16-5-13-45-51-23-0-65037,29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 17513, "name": "application_settings", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 1, "first_seen": 1791142069, "last_seen": 1791142069, "transport": "t", "ja3_hash": "e690771cdb4f2d21db4ff551e31c86fb", "ja3_variant_count": 1, "ja3_variants": [ "e690771cdb4f2d21db4ff551e31c86fb" ], "user_agents": { "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d1512h2_8daaf6152771_373adbb9a055", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1512h2", "b": "8daaf6152771", "c": "373adbb9a055", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-5-10-16-35-18-13-17613-27-65037-65281-51,4588-29-23-24,", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 5, "name": "status_request", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [] }, "observed": { "count": 2, "first_seen": 1788945448, "last_seen": 1790990968, "transport": "t", "ja3_hash": "fd5780ba68132b41a6077cb18eeb3e63", "ja3_variant_count": 2, "ja3_variants": [ "fd5780ba68132b41a6077cb18eeb3e63", "5972ea846f163d8f3c5550a70764e175" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36": 1, "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36": 10 }, "ua_disagreement": false } }, { "hash": "t12d1512h2_8daaf6152771_44560a4cbd15", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1512h2", "b": "8daaf6152771", "c": "44560a4cbd15", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,10-65037-35-11-51-23-18-17513-27-16-0-13,29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 10, "name": "supported_groups", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 35, "name": "session_ticket", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 51, "name": "key_share", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true }, { "value": 17513, "name": "application_settings", "known": true }, { "value": 27, "name": "compress_certificate", "known": true }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 0, "name": "server_name", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true } ], "curves": [ { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1791298590, "last_seen": 1791298590, "transport": "t", "ja3_hash": "6ef841a839d9e7a81c54f3ac8a080126", "ja3_variant_count": 1, "ja3_variants": [ "6ef841a839d9e7a81c54f3ac8a080126" ], "user_agents": { "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36": 1 }, "ua_disagreement": false } }, { "hash": "t12d1512h2_8daaf6152771_4c5845513145", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Safari \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1512h2", "b": "8daaf6152771", "c": "4c5845513145", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-17613-51764-16-13-23-10-45-65281-11-65037-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 0, "name": "server_name", "known": true }, { "value": 17613, "name": "17613 (0x44cd)", "known": false }, { "value": 51764, "name": "51764 (0xca34)", "known": false }, { "value": 16, "name": "application_layer_protocol_negotiation", "known": true }, { "value": 13, "name": "signature_algorithms", "known": true }, { "value": 23, "name": "extended_master_secret", "known": true }, { "value": 10, "name": "supported_groups", "known": true }, { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 65281, "name": "renegotiation_info", "known": true }, { "value": 11, "name": "ec_point_formats", "known": true }, { "value": 65037, "name": "encrypted_client_hello", "known": true }, { "value": 51, "name": "key_share", "known": true } ], "curves": [ { "value": 4588, "name": "SecP256r1MLKEM768", "known": true }, { "value": 29, "name": "x25519", "known": true }, { "value": 23, "name": "secp256r1", "known": true }, { "value": 24, "name": "secp384r1", "known": true } ], "point_formats": [ { "value": 0, "name": "uncompressed", "known": true } ] }, "observed": { "count": 1, "first_seen": 1790701420, "last_seen": 1790701420, "transport": "t", "ja3_hash": "9311648bf7040225f3cbc5ce602a8f1b", "ja3_variant_count": 1, "ja3_variants": [ "9311648bf7040225f3cbc5ce602a8f1b" ], "user_agents": { "Mozilla/5.0 (iPhone; CPU iPhone OS 15_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/26.5 Mobile/15E148 Safari/604.1": 10 }, "ua_disagreement": false } }, { "hash": "t12d1512h2_8daaf6152771_5037d0870074", "kind": "ja4", "tier": "observed", "classification": "browser", "description": "Chrome \u2014 inferred from the User-Agent on its requests.", "ja4": { "a": "t12d1512h2", "b": "8daaf6152771", "c": "5037d0870074", "properties": { "transport": "TCP", "tls_version": "TLS 1.2", "sni": "server name sent", "cipher_count": 15, "extension_count": 12, "alpn": "h2" } }, "ja3_string": "771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,45-18-10-5-13-23-65281-0-11-27-16-51,4588-29-23-24,0", "ja3_decoded": { "version": { "value": 771, "name": "TLS 1.2" }, "ciphers": [ { "value": 4865, "name": "TLS_AES_128_GCM_SHA256", "known": true }, { "value": 4866, "name": "TLS_AES_256_GCM_SHA384", "known": true }, { "value": 4867, "name": "TLS_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49195, "name": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49199, "name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 49196, "name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 49200, "name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 52393, "name": "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 52392, "name": "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "known": true }, { "value": 49171, "name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 49172, "name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "known": true }, { "value": 156, "name": "TLS_RSA_WITH_AES_128_GCM_SHA256", "known": true }, { "value": 157, "name": "TLS_RSA_WITH_AES_256_GCM_SHA384", "known": true }, { "value": 47, "name": "TLS_RSA_WITH_AES_128_CBC_SHA", "known": true }, { "value": 53, "name": "TLS_RSA_WITH_AES_256_CBC_SHA", "known": true } ], "extensions": [ { "value": 45, "name": "psk_key_exchange_modes", "known": true }, { "value": 18, "name": "signed_certificate_timestamp", "known": true